📚 Kubernetes Study - CKS Certification

starting up the stream and just putting starting up the stream and just putting this in the screen so everybody knows this in the screen so everybody knows this in the screen so everybody knows what to expect what to expect what to expect here not necessar neily going to be here not necessar neily going to be here not necessar neily going to be chatting or talking too much because I chatting or talking too much because I chatting or talking too much because I need to actually focus on my studies of need to actually focus on my studies of need to actually focus on my studies of course planning to do two pomodoros course planning to do two pomodoros course planning to do two pomodoros today of 50 minutes so about two hours today of 50 minutes so about two hours today of 50 minutes so about two hours of study of study of study time maybe I'll do some Network policies time maybe I'll do some Network policies time maybe I'll do some Network policies after that but uh we'll see how the next after that but uh we'll see how the next after that but uh we'll see how the next two hours are going to cks points we will talk about not metad cks points we will talk about not metad data when it comes to Cloud platforms data when it comes to Cloud platforms data when it comes to Cloud platforms what it is next we will actually access what it is next we will actually access what it is next we will actually access sensitive not metad data and finally we sensitive not metad data and finally we sensitive not metad data and finally we will restrict it using network will restrict it using network will restrict it using network policies Cloud platform note metadata policies Cloud platform note metadata policies Cloud platform note metadata what is this if we spin up virtual what is this if we spin up virtual what is this if we spin up virtual machines in the cloud provider of our machines in the cloud provider of our machines in the cloud provider of our choice Google Cloud AWS choice Google Cloud AWS choice Google Cloud AWS AIA then there's usually a metadata AIA then there's usually a metadata AIA then there's usually a metadata server which we don't manage which the

server which we don't manage which the server which we don't manage which the cloud provider manages for us but the cloud provider manages for us but the cloud provider manages for us but the virtual machines are able to connect virtual machines are able to connect virtual machines are able to connect with this metadata server and get some with this metadata server and get some with this metadata server and get some information about the environment about information about the environment about information about the environment about the service account they use and there the service account they use and there the service account they use and there can be credentials and sensitive can be credentials and sensitive can be credentials and sensitive information to spin up um their information to spin up um their information to spin up um their services so metadata service API is by services so metadata service API is by services so metadata service API is by default reachable from virtual machines default reachable from virtual machines default reachable from virtual machines it can contain Cloud credentials for VMS it can contain Cloud credentials for VMS it can contain Cloud credentials for VMS and N so sensitive and N so sensitive and N so sensitive information are able to connect with information are able to connect with information are able to connect with this metadata server and use and they this metadata server and use and they this metadata server and use and they can their services machines it can this can their services machines it can this can their services machines it can this can mean for example data to provision can mean for example data to provision can mean for example data to provision the CET credentials on on a worker the CET credentials on on a worker the CET credentials on on a worker note so limiting deposition uh the note so limiting deposition uh the note so limiting deposition uh the permissions for instance credentials permissions for instance credentials permissions for instance credentials this is kind of outside of the scope of this is kind of outside of the scope of this is kind of outside of the scope of kubernetes This Means ensuring that the kubernetes This Means ensuring that the kubernetes This Means ensuring that the cloud instance account so the account cloud instance account so the account cloud instance account so the account which the instance can use to connect to which the instance can use to connect to which the instance can use to connect to the metadata server or to other apis um the metadata server or to other apis um the metadata server or to other apis um that it only has the necessary that it only has the necessary that it only has the necessary permissions right and each cloud permissions right and each cloud permissions right and each cloud provider has a set of recommendations provider has a set of recommendations provider has a set of recommendations for it some maybe have good default for it some maybe have good default for it some maybe have good default settings for some you might have to settings for some you might have to settings for some you might have to adjust it but this is not in the hands adjust it but this is not in the hands adjust it but this is not in the hands of kubernetes and this goes too much of kubernetes and this goes too much of kubernetes and this goes too much into Cloud management um but it's just into Cloud management um but it's just into Cloud management um but it's just something that you should be aware of restricting access using network of restricting access using network policies well if we have now a cloud

policies well if we have now a cloud policies well if we have now a cloud account like uh in Google cloud like we account like uh in Google cloud like we account like uh in Google cloud like we actually have and um we build our own actually have and um we build our own actually have and um we build our own kubernetes cluster as we see here then kubernetes cluster as we see here then kubernetes cluster as we see here then we might have a worker node virtual we might have a worker node virtual we might have a worker node virtual machine right as we do we have one machine right as we do we have one machine right as we do we have one master and one worker and then in that master and one worker and then in that master and one worker and then in that worker we have some pots running which worker we have some pots running which worker we have some pots running which are actually run as processes uh as are actually run as processes uh as are actually run as processes uh as Stocker containers and processes Stocker containers and processes Stocker containers and processes internally on the operating system and internally on the operating system and internally on the operating system and then by default these pots and then by default these pots and then by default these pots and containers can also contact the metadata containers can also contact the metadata containers can also contact the metadata server right so it's not even a matter server right so it's not even a matter server right so it's not even a matter that that someone has to break out of a that that someone has to break out of a that that someone has to break out of a container and then from the node contact container and then from the node contact container and then from the node contact the metadata server like even before the metadata server like even before the metadata server like even before this without usually with the default this without usually with the default this without usually with the default configuration it's possible for pots to configuration it's possible for pots to configuration it's possible for pots to contact the metadata server and maybe to contact the metadata server and maybe to contact the metadata server and maybe to query sensitive query sensitive query sensitive information so what we can do with information so what we can do with information so what we can do with network policies is to allow certain network policies is to allow certain network policies is to allow certain poorts to access these and to deny poorts to access these and to deny poorts to access these and to deny certain parts to access certain parts to access certain parts to access these we will now access gcp Google Cloud we will now access gcp Google Cloud metadata from an instance and from a metadata from an instance and from a metadata from an instance and from a pot for this I'm on my master note the pot for this I'm on my master note the pot for this I'm on my master note the cluster is ready as cluster is ready as cluster is ready as always and I'm actually on a Google always and I'm actually on a Google always and I'm actually on a Google Cloud page called storing and retrieving Cloud page called storing and retrieving Cloud page called storing and retrieving instance metadata the link is in the

instance metadata the link is in the instance metadata the link is in the resources section of this video and this resources section of this video and this resources section of this video and this again accessing the metadata server the again accessing the metadata server the again accessing the metadata server the metadata server exists for most Cloud metadata server exists for most Cloud metadata server exists for most Cloud providers but it's it's different it's providers but it's it's different it's providers but it's it's different it's cloud provider depend on how to access cloud provider depend on how to access cloud provider depend on how to access it right it might be just the IP it it right it might be just the IP it it right it might be just the IP it might be a domain name that you have to might be a domain name that you have to might be a domain name that you have to cre so it's dependent but here also you cre so it's dependent but here also you cre so it's dependent but here also you see caution a process can create the see caution a process can create the see caution a process can create the metadata URL a process that can create metadata URL a process that can create metadata URL a process that can create the metadata URL has access to all the metadata URL has access to all the metadata URL has access to all values in the metadata server so there values in the metadata server so there values in the metadata server so there are some examples so we can simply are some examples so we can simply are some examples so we can simply search for curl and I saw something search for curl and I saw something search for curl and I saw something about quering discs exactly so we simply about quering discs exactly so we simply about quering discs exactly so we simply copy the copy the copy the comand execute it and we see we we comand execute it and we see we we comand execute it and we see we we actually got a got a response and um we actually got a got a response and um we actually got a got a response and um we we get some information back so it's not we get some information back so it's not we get some information back so it's not really about the information that we get really about the information that we get really about the information that we get back right now it's simply the fact that back right now it's simply the fact that back right now it's simply the fact that we can connect to the metadata we can connect to the metadata we can connect to the metadata server now we see that we can do it from server now we see that we can do it from server now we see that we can do it from the instance from the master instance it the instance from the master instance it the instance from the master instance it will work the same from the from the will work the same from the from the will work the same from the from the worker instance it's simply two virtual worker instance it's simply two virtual worker instance it's simply two virtual machines but now the thing is it also machines but now the thing is it also machines but now the thing is it also works from pots so we create a simple works from pots so we create a simple works from pots so we create a simple pot called engine X image engine X it pot called engine X image engine X it pot called engine X image engine X it already exists great um I simply exac already exists great um I simply exac already exists great um I simply exac into it get a shell and then run into it get a shell and then run into it get a shell and then run the same the same the same command and we see it works okay so by command and we see it works okay so by command and we see it works okay so by default we see now that pots can access

default we see now that pots can access default we see now that pots can access the gcp metadata the gcp metadata the gcp metadata server I never I never knew about that server I never I never knew about that server I never I never knew about that so that's interesting so how does this so that's interesting so how does this so that's interesting so how does this work in Azure Azure metad data server Azure instance metadata server Azure instance metadata service provides information about service provides information about service provides information about currently running virtual machine currently running virtual machine currently running virtual machine instances you can use it to manage and instances you can use it to manage and instances you can use it to manage and configure your virtual machines that is really interesting so you must B that is really interesting so you must B you must bypass proxies didn't know you could do that proxies didn't know you could do that but that does mean yeah security authentication is mean yeah security authentication is only accessible from within a running only accessible from within a running only accessible from within a running virtual machine instance on a virtual machine instance on a virtual machine instance on a non-routable IP non-routable IP non-routable IP address VMS can only interact with their address VMS can only interact with their address VMS can only interact with their own metadata and own metadata and own metadata and functionality functionality functionality h i mean of course you don't want that h i mean of course you don't want that h i mean of course you don't want that open but does that really contain open but does that really contain open but does that really contain important information like it I can important information like it I can important information like it I can hardly imagine they would have hardly imagine they would have hardly imagine they would have credentials in there or credentials in there or credentials in there or passwords secret it would give this location of secret it would give this location of the secret and pass

secret and pass [Music] word don't think you could actually get word don't think you could actually get hackable information from there but yeah hackable information from there but yeah hackable information from there but yeah it's still good to it's still good to it's still good to know learn something new that we will now only allow certain that we will now only allow certain parts having a certain label to access parts having a certain label to access parts having a certain label to access the Endo for this we will create two the Endo for this we will create two the Endo for this we will create two Network policies which are actually in Network policies which are actually in Network policies which are actually in our GitHub repository the link is in the our GitHub repository the link is in the our GitHub repository the link is in the resources of this video I mean we have resources of this video I mean we have resources of this video I mean we have um already a big section about Network um already a big section about Network um already a big section about Network policy so we don't go very in very much policy so we don't go very in very much policy so we don't go very in very much into detail here and we simply create into detail here and we simply create into detail here and we simply create the two existing Network policies and the two existing Network policies and the two existing Network policies and have a look at them the first one we have a look at them the first one we have a look at them the first one we want to have a look at is the deny one want to have a look at is the deny one want to have a look at is the deny one so npcloud metadata so npcloud metadata so npcloud metadata deny and here we see that we have a PO deny and here we see that we have a PO deny and here we see that we have a PO selector for everything so not just selector for everything so not just selector for everything so not just specific pods this will be for all pods specific pods this will be for all pods specific pods this will be for all pods in the namespace default it's about in the namespace default it's about in the namespace default it's about outgoing traffic and we have one outgoing traffic and we have one outgoing traffic and we have one outgoing traffic rule which means we outgoing traffic rule which means we outgoing traffic rule which means we allow outgoing traffic to all IP allow outgoing traffic to all IP allow outgoing traffic to all IP addresses except the one of the metadata addresses except the one of the metadata addresses except the one of the metadata server okay and that IP address um we server okay and that IP address um we server okay and that IP address um we can see if can see if can see if we ping that one that's the IP address we ping that one that's the IP address we ping that one that's the IP address of the metadata Google internal server

of the metadata Google internal server of the metadata Google internal server okay copy the network policy and create okay copy the network policy and create okay copy the network policy and create it I call the file deny. yo there we go it I call the file deny. yo there we go it I call the file deny. yo there we go it's already it's already it's already here and I will create here and I will create here and I will create it there we go we exec back into our it there we go we exec back into our it there we go we exec back into our engine engine engine expert and we try to run curl again and expert and we try to run curl again and expert and we try to run curl again and it doesn't work it doesn't work it doesn't work okay this might be something that's a okay this might be something that's a okay this might be something that's a good procedure to do to deny to access good procedure to do to deny to access good procedure to do to deny to access the metadata server now we go ahead and the metadata server now we go ahead and the metadata server now we go ahead and look at the second one npcloud metadata look at the second one npcloud metadata look at the second one npcloud metadata allow here we have a PO selector for R allow here we have a PO selector for R allow here we have a PO selector for R metadata accessor and these metadata metadata accessor and these metadata metadata accessor and these metadata accessor we allow We additionally allow accessor we allow We additionally allow accessor we allow We additionally allow aggress to IP block and then the IP of aggress to IP block and then the IP of aggress to IP block and then the IP of the um metadata server so this second the um metadata server so this second the um metadata server so this second one if you would only create this one one if you would only create this one one if you would only create this one alone then these pots would only have alone then these pots would only have alone then these pots would only have access to this IP address okay but if access to this IP address okay but if access to this IP address okay but if you create it in conjunction together you create it in conjunction together you create it in conjunction together with the deny with the deny with the deny one then pots will get this rule so they one then pots will get this rule so they one then pots will get this rule so they can connect to everything except this can connect to everything except this can connect to everything except this one plus the other rule that they can one plus the other rule that they can one plus the other rule that they can connect to this one okay might be a bit connect to this one okay might be a bit connect to this one okay might be a bit confusing maybe pause the video and uh confusing maybe pause the video and uh confusing maybe pause the video and uh look at those and um just imagine that

look at those and um just imagine that look at those and um just imagine that if the deny Network policy and the allow if the deny Network policy and the allow if the deny Network policy and the allow Network policy would be merged then the Network policy would be merged then the Network policy would be merged then the first rule would be invalidated by the first rule would be invalidated by the first rule would be invalidated by the second rule kind of so go ahead copy the second rule kind of so go ahead copy the second rule kind of so go ahead copy the allow Network policy I call it allow. allow Network policy I call it allow. allow Network policy I call it allow. yo yeah it's really good that he's yo yeah it's really good that he's yo yeah it's really good that he's emphasizing this because this was really emphasizing this because this was really emphasizing this because this was really confusing uh in the beginning when I was confusing uh in the beginning when I was confusing uh in the beginning when I was learning these policies but basically learning these policies but basically learning these policies but basically all of the policies in the namespace get all of the policies in the namespace get all of the policies in the namespace get merged into one and then everything gets merged into one and then everything gets merged into one and then everything gets added and that's the final added and that's the final added and that's the final policy and create it great now if we have a look at the it great now if we have a look at the pots and their pots and their pots and their labels then we see right now it has the labels then we see right now it has the labels then we see right now it has the label run engine X and we would like to label run engine X and we would like to label run engine X and we would like to give it the label row metadata accessor give it the label row metadata accessor give it the label row metadata accessor to to to test so what we can do is K label test so what we can do is K label test so what we can do is K label Po and we Po and we Po and we say row metadata accessor K label po the say row metadata accessor K label po the say row metadata accessor K label po the name is engine X there we go we check name is engine X there we go we check name is engine X there we go we check labels again and now our engine export labels again and now our engine export labels again and now our engine export has the label row metadata accessor okay has the label row metadata accessor okay has the label row metadata accessor okay we exct back into the PO and we can see we exct back into the PO and we can see we exct back into the PO and we can see yes we can curl the m data yes we can curl the m data yes we can curl the m data service and to verify that it actually

service and to verify that it actually service and to verify that it actually works I going to remove the label again works I going to remove the label again works I going to remove the label again so we see here in my pot I have the so we see here in my pot I have the so we see here in my pot I have the label row metadata accessor I will label row metadata accessor I will label row metadata accessor I will remove it again ex back into the pot try remove it again ex back into the pot try remove it again ex back into the pot try to execute it again and it doesn't work to execute it again and it doesn't work to execute it again and it doesn't work okay so yeah play around with this a okay so yeah play around with this a okay so yeah play around with this a little bit um using this we were able to little bit um using this we were able to little bit um using this we were able to default deny for all pots the access to default deny for all pots the access to default deny for all pots the access to the metadata endpoint the metadata endpoint the metadata endpoint and then simply allow it for certain CS and then simply allow it for certain CS and then simply allow it for certain CS having a certain LEL and just a quick recap to end this LEL and just a quick recap to end this section we talked about Cloud metadata section we talked about Cloud metadata section we talked about Cloud metadata servers we talked about that they're servers we talked about that they're servers we talked about that they're different for every cloud provider how different for every cloud provider how different for every cloud provider how to access them usually it's possible to to access them usually it's possible to to access them usually it's possible to access them from every in instance and access them from every in instance and access them from every in instance and usually instances they access which usually instances they access which usually instances they access which use okay let's do a killer Coda scenario use okay let's do a killer Coda scenario use okay let's do a killer Coda scenario but that was but that was but that was yeah rather easy subject matter um metad yeah rather easy subject matter um metad yeah rather easy subject matter um metad Data Network policy metadata protection Data Network policy metadata protection Data Network policy metadata protection oh I I even have already solved this one oh I I even have already solved this one oh I I even have already solved this one because I've been practicing Network because I've been practicing Network because I've been practicing Network policies so much policies so much policies so much but let me see we can U if I can solve but let me see we can U if I can solve but let me see we can U if I can solve this this this one on the one on the one on the cuff off the cuff off the cuff off the cuff we assuming there's a cuff we assuming there's a cuff we assuming there's a yeah

okay create network policy named okay create network policy named metadata server in namespace default metadata server in namespace default metadata server in namespace default which restricts all egress traffic to which restricts all egress traffic to which restricts all egress traffic to that IP so it should allow all egress traffic IP so it should allow all egress traffic except to that IP so I will go to the except to that IP so I will go to the except to that IP so I will go to the kubernetes docs Concepts and networking Network policies and for and networking Network policies and for these exams it's really important that these exams it's really important that these exams it's really important that you learn how to navigate the docs you learn how to navigate the docs you learn how to navigate the docs efficiently I've even heard people say efficiently I've even heard people say efficiently I've even heard people say that the search doesn't work sometimes that the search doesn't work sometimes that the search doesn't work sometimes so that is a real problem so it's good so that is a real problem so it's good so that is a real problem so it's good to also know your way around the sidebar to also know your way around the sidebar to also know your way around the sidebar here so you don't rely on here so you don't rely on here so you don't rely on search so Vim NP search so Vim NP search so Vim NP y insert this example that I grabbed y insert this example that I grabbed y insert this example that I grabbed from the docs let's go through it one by from the docs let's go through it one by from the docs let's go through it one by one create a network policy named one create a network policy named one create a network policy named metadata server server server in namespace default which restricts all egress default which restricts all egress traffic to the IP so we're not going to traffic to the IP so we're not going to traffic to the IP so we're not going to be concerned with be concerned with be concerned with Ingress Ingress Ingress and here's this example IP block cider and here's this example IP block cider and here's this example IP block cider accept so I'm going to paste that there accept so I'm going to paste that there accept so I'm going to paste that there then I can delete all of the Ingress

here here so I'm saying that traffic is allowed that traffic is allowed to the internet internet Z Z Z oops 0 0 0 so this sl32 and the Nam space was default the sl32 and the Nam space was default the Pod selector will be all it apply that it apply that one NE policy created and then let's see one NE policy created and then let's see one NE policy created and then let's see ncv ncv ncv 111 53 and it succeeded so I probably have 53 and it succeeded so I probably have it the other way around the wrong way

around oh yeah here we go I forgot the around oh yeah here we go I forgot the network policy should only affect pods network policy should only affect pods network policy should only affect pods with label trust is no with label trust is no with label trust is no so we actually have to do a selector so we actually have to do a selector so we actually have to do a selector here what selector match here what selector match here what selector match labels forgot about that one one [Music] [Music] [Music] so what selector match so what selector match so what selector match labels trust is labels trust is labels trust is nope Trust nope Trust nope Trust nope here we go apply it again now K get pods show again now K get pods show labels there are two pods and yeah no trust and Trust so let's go and yeah no trust and Trust so let's go into the exec into the exec into the exec it trust Z bash or I can just execute the command I bash or I can just execute the command I don't have to be interactive NC don't have to be interactive NC don't have to be interactive NC v1111 53 so from this part it's open and then 53 so from this part it's open and then now if I go to

go to the no trust the no trust the no trust [Music] [Music] [Music] zero the command doesn't work because zero the command doesn't work because zero the command doesn't work because I'm selecting that pod with the trust is I'm selecting that pod with the trust is I'm selecting that pod with the trust is nope so it won't work so the scenario nope so it won't work so the scenario nope so it won't work so the scenario should solve should solve should solve now check now check now check it yep validation it yep validation it yep validation successful all right that was easy easy okay on to the next module then CIS benchmarks oh this is going to then CIS benchmarks oh this is going to be fun this going to be completely new be fun this going to be completely new be fun this going to be completely new to me I've never done this before use to me I've never done this before use to me I've never done this before use CIS benchmarks to review security CIS benchmarks to review security CIS benchmarks to review security configuration I will first give you a configuration I will first give you a configuration I will first give you a little introductional overview about little introductional overview about little introductional overview about what CS benchmarks are what CS benchmarks are what CS benchmarks are then we will jump right into a Hands-On then we will jump right into a Hands-On then we will jump right into a Hands-On session CS benchmarks in action and session CS benchmarks in action and session CS benchmarks in action and later on we will use Cube bench to later on we will use Cube bench to later on we will use Cube bench to investigate our cluster and to apply investigate our cluster and to apply investigate our cluster and to apply security security security recommendations CIS benchmarks so CIS is recommendations CIS benchmarks so CIS is recommendations CIS benchmarks so CIS is the center for Internet Security and the center for Internet Security and the center for Internet Security and they provide best practices for security they provide best practices for security they provide best practices for security configuration of Target systems and they configuration of Target systems and they configuration of Target systems and they cover as of now more than 14 different cover as of now more than 14 different cover as of now more than 14 different technology groups which means not just technology groups which means not just technology groups which means not just kubernetes okay they have kubernetes okay they have kubernetes okay they have recommendations for for different recommendations for for different recommendations for for different software products and to site CIS

software products and to site CIS software products and to site CIS benchmarks is developed through unic benchmarks is developed through unic benchmarks is developed through unic consensus based process comprised of consensus based process comprised of consensus based process comprised of cyber Security Professionals and subject cyber Security Professionals and subject cyber Security Professionals and subject matter experts around the world well if matter experts around the world well if matter experts around the world well if that doesn't make you feel more secure that doesn't make you feel more secure that doesn't make you feel more secure then I don't know what then I don't know what then I don't know what will okay CS benchmarks so CS benchmarks will okay CS benchmarks so CS benchmarks will okay CS benchmarks so CS benchmarks now just kubernetes because that's now just kubernetes because that's now just kubernetes because that's interesting for us they provide default interesting for us they provide default interesting for us they provide default kubernetes security rules we as kubernetes security rules we as kubernetes security rules we as administrators let's say we administrators let's say we administrators let's say we administrator admin rate our own cluster administrator admin rate our own cluster administrator admin rate our own cluster we can then just use these rules and use we can then just use these rules and use we can then just use these rules and use that and apply them like if we have a that and apply them like if we have a that and apply them like if we have a cluster we set it up with Rancher or we cluster we set it up with Rancher or we cluster we set it up with Rancher or we set it up with Cube ADM we can use these set it up with Cube ADM we can use these set it up with Cube ADM we can use these rules and um apply them and then we now rules and um apply them and then we now rules and um apply them and then we now we have already a good security base we have already a good security base we have already a good security base right and if you want to adjust this right and if you want to adjust this right and if you want to adjust this then you can do it as well like if then you can do it as well like if then you can do it as well like if you're a big company and um like for you're a big company and um like for you're a big company and um like for example Google cloud and AWS they do example Google cloud and AWS they do example Google cloud and AWS they do this for their managed kubernetes this for their managed kubernetes this for their managed kubernetes solutions they use the Cs benchmarks as solutions they use the Cs benchmarks as solutions they use the Cs benchmarks as a base a base a base they customize them and then they use they customize them and then they use they customize them and then they use and apply them Google does it a bit and apply them Google does it a bit and apply them Google does it a bit longer already and um they provide longer already and um they provide longer already and um they provide online a list so it's like transparent online a list so it's like transparent online a list so it's like transparent which rules they take which rules they which rules they take which rules they which rules they take which rules they maybe Define more strict to be and which maybe Define more strict to be and which maybe Define more strict to be and which rules they Define less strict to be rules they Define less strict to be rules they Define less strict to be right and then it's really transparent right and then it's really transparent right and then it's really transparent from security because security is best from security because security is best from security because security is best when it's transparent so I like this um when it's transparent so I like this um when it's transparent so I like this um yeah and then you can see what rules are yeah and then you can see what rules are yeah and then you can see what rules are applied so if you are a company um which applied so if you are a company um which applied so if you are a company um which is pretty large enough and you want to

is pretty large enough and you want to is pretty large enough and you want to customize the CIS benchmarks then you customize the CIS benchmarks then you customize the CIS benchmarks then you can do this as well before you apply can do this as well before you apply can do this as well before you apply them so that's the general idea of CIS benchmarks okay in this Hands-On session benchmarks okay in this Hands-On session we will actually download and we will actually download and we will actually download and investigate the kubernetes benchmarks investigate the kubernetes benchmarks investigate the kubernetes benchmarks PDF okay so for this you have to head to PDF okay so for this you have to head to PDF okay so for this you have to head to your browser and search really difficult your browser and search really difficult your browser and search really difficult C benchmark C benchmark C benchmark kubernetes and then you should see the kubernetes and then you should see the kubernetes and then you should see the website c c security.org you click on website c c security.org you click on website c c security.org you click on kubernetes benchmarks and download kubernetes benchmarks and download kubernetes benchmarks and download latest CIS benchmarks you can see for me latest CIS benchmarks you can see for me latest CIS benchmarks you can see for me right now it's version 160 just download right now it's version 160 just download right now it's version 160 just download the latest version for you and yes it is the latest version for you and yes it is the latest version for you and yes it is free but um just pause the video now free but um just pause the video now free but um just pause the video now fill in the fill in the fill in the information click the button wait for information click the button wait for information click the button wait for the email and then you can download the the email and then you can download the the email and then you can download the PDF pause the video do it now there you PDF pause the video do it now there you PDF pause the video do it now there you go you should have your PDF open you see go you should have your PDF open you see go you should have your PDF open you see I have the PDF open I'm using version I have the PDF open I'm using version I have the PDF open I'm using version 160 and what should we do in the 10th on 160 and what should we do in the 10th on 160 and what should we do in the 10th on session check kubernetes version of your session check kubernetes version of your session check kubernetes version of your document what does this mean okay document what does this mean okay document what does this mean okay because it was a bit confusing because because it was a bit confusing because because it was a bit confusing because the numbers doesn't mean it doesn't have the numbers doesn't mean it doesn't have the numbers doesn't mean it doesn't have anything to do with the number of the anything to do with the number of the anything to do with the number of the kubernetes cluster a kubernetes version kubernetes cluster a kubernetes version kubernetes cluster a kubernetes version that this is applied to okay so we that this is applied to okay so we that this is applied to okay so we scroll down a little bit um okay at scroll down a little bit um okay at scroll down a little bit um okay at first we see the um the content of the first we see the um the content of the first we see the um the content of the do and the content is structured we see do and the content is structured we see do and the content is structured we see one are the control plane components

one are the control plane components one are the control plane components Master node for example and if we scroll Master node for example and if we scroll Master node for example and if we scroll down um to section two we see it section down um to section two we see it section down um to section two we see it section two is about at CD and then section four two is about at CD and then section four two is about at CD and then section four is about worker nodes right so that's is about worker nodes right so that's is about worker nodes right so that's how it's structured and then there are how it's structured and then there are how it's structured and then there are like various rules for the various like various rules for the various like various rules for the various components of components of components of kubernetes and if we scroll further down kubernetes and if we scroll further down kubernetes and if we scroll further down there should be an overview section in there should be an overview section in there should be an overview section in the overview section you see this the overview section you see this the overview section you see this document is made for Cuties versions 116 document is made for Cuties versions 116 document is made for Cuties versions 116 and 118 we right now work with and 118 we right now work with and 118 we right now work with 119 but um yeah I mean it doesn't it 119 but um yeah I mean it doesn't it 119 but um yeah I mean it doesn't it doesn't matter just just use if you work doesn't matter just just use if you work doesn't matter just just use if you work with a kubernetes version which is above with a kubernetes version which is above with a kubernetes version which is above or like one or two versions above um not or like one or two versions above um not or like one or two versions above um not that much should have changed okay and that much should have changed okay and that much should have changed okay and what's also important is that these what's also important is that these what's also important is that these rules are applied by the default rules are applied by the default rules are applied by the default configuration of cube ADM so wherever configuration of cube ADM so wherever configuration of cube ADM so wherever Cube ADM puts its configuration files Cube ADM puts its configuration files Cube ADM puts its configuration files this document uses this already and this this document uses this already and this this document uses this already and this is great because the is great because the is great because the cks um the Clusters that you use in the cks um the Clusters that you use in the cks um the Clusters that you use in the cks certification are all configured cks certification are all configured cks certification are all configured using Cube ADM okay and we also use Cube using Cube ADM okay and we also use Cube using Cube ADM okay and we also use Cube ADM in this course so that's all perfect ADM in this course so that's all perfect ADM in this course so that's all perfect okay now we just look at two example okay now we just look at two example okay now we just look at two example rules okay so in my document it's page rules okay so in my document it's page rules okay so in my document it's page 16 rule 111 it might be on a different 16 rule 111 it might be on a different 16 rule 111 it might be on a different page for you but the the rule number page for you but the the rule number page for you but the the rule number should be the same so I go to page 16 should be the same so I go to page 16 should be the same so I go to page 16 it's actually 17 for me okay let's just it's actually 17 for me okay let's just it's actually 17 for me okay let's just have a look at one example rule okay have a look at one example rule okay have a look at one example rule okay just that you a bit uh con that you get

just that you a bit uh con that you get just that you a bit uh con that you get a bit used to how the documents are a bit used to how the documents are a bit used to how the documents are structured so we are at Master node structured so we are at Master node structured so we are at Master node configuration and configuration and configuration and 1.111 ensure that the API server po 1.111 ensure that the API server po 1.111 ensure that the API server po specification file permissions are set specification file permissions are set specification file permissions are set to 644 or more to 644 or more to 644 or more restrictive okay and then you simply restrictive okay and then you simply restrictive okay and then you simply have a description what it is okay so we have a description what it is okay so we have a description what it is okay so we have to check some file permissions and have to check some file permissions and have to check some file permissions and then you have an audit so you can then you have an audit so you can then you have an audit so you can actually run this this command to check actually run this this command to check actually run this this command to check what the file permissions are and then what the file permissions are and then what the file permissions are and then you check if it's less or more you check if it's less or more you check if it's less or more restrictive okay and if it's not like restrictive okay and if it's not like restrictive okay and if it's not like that then you see the comment that you that then you see the comment that you that then you see the comment that you can execute to fix it okay so you have a can execute to fix it okay so you have a can execute to fix it okay so you have a comment to execute to check it and you comment to execute to check it and you comment to execute to check it and you have a comment to execute to fix it it's have a comment to execute to fix it it's have a comment to execute to fix it it's really simple really simple really simple okay um let's have a look at another okay um let's have a look at another okay um let's have a look at another example as yeah okay so it's just a set example as yeah okay so it's just a set example as yeah okay so it's just a set of best practices and I I work mostly of best practices and I I work mostly of best practices and I I work mostly with Azure kubernetes service and they with Azure kubernetes service and they with Azure kubernetes service and they have this amazing AKs best practices guide and amazing AKs best practices guide and like in general you don't even have like in general you don't even have like in general you don't even have access to this kind of stuff on a access to this kind of stuff on a access to this kind of stuff on a managed kubernetes cluster like AKs so managed kubernetes cluster like AKs so managed kubernetes cluster like AKs so you won't be able to even do this kind you won't be able to even do this kind you won't be able to even do this kind of auditing but even then the the AKs of auditing but even then the the AKs of auditing but even then the the AKs offering has these cluster operator best offering has these cluster operator best offering has these cluster operator best practices which is just amazing it has practices which is just amazing it has practices which is just amazing it has so much good so much good so much good information and um you can just go information and um you can just go information and um you can just go through it for your for your through it for your for your through it for your for your organization and do all of the steps and organization and do all of the steps and organization and do all of the steps and make sure that you will comply and even

make sure that you will comply and even make sure that you will comply and even the Microsoft Defender will also detect the Microsoft Defender will also detect the Microsoft Defender will also detect this so it will actually detect whether this so it will actually detect whether this so it will actually detect whether you are conforming to some of these best you are conforming to some of these best you are conforming to some of these best practices it's actually really good but practices it's actually really good but practices it's actually really good but this kind of stuff um on manage this kind of stuff um on manage this kind of stuff um on manage kubernetes you are not even able to to kubernetes you are not even able to to kubernetes you are not even able to to adjust and I I'm fairly sure you can't adjust and I I'm fairly sure you can't adjust and I I'm fairly sure you can't even do it with on Talus either because even do it with on Talus either because even do it with on Talus either because you can't even access the node itself you can't even access the node itself you can't even access the node itself you can't SSH into Talos nodes you can you can't SSH into Talos nodes you can you can't SSH into Talos nodes you can only uh use the Talos API well for me only uh use the Talos API well for me only uh use the Talos API well for me it's on page 208 for the worker note it's on page 208 for the worker note it's on page 208 for the worker note rule 4 to10 so page 208 rule 208 rule 4210 ensure that the TLs SE file and TLS 4210 ensure that the TLs SE file and TLS 4210 ensure that the TLs SE file and TLS private file arguments are set as private file arguments are set as private file arguments are set as appropriate okay and then for auditing appropriate okay and then for auditing appropriate okay and then for auditing we do a PS so we look at the process and we do a PS so we look at the process and we do a PS so we look at the process and we look with which parameters the we look with which parameters the we look with which parameters the process is run then we have a process is run then we have a process is run then we have a recommendation and then uh in the recommendation and then uh in the recommendation and then uh in the recommendation it says how we where we recommendation it says how we where we recommendation it says how we where we can change it we see in this config file can change it we see in this config file can change it we see in this config file we can change it what we should do and we can change it what we should do and we can change it what we should do and then we have to restart the service and then we have to restart the service and then we have to restart the service and do it like this okay feel free to check do it like this okay feel free to check do it like this okay feel free to check a few rules out not at all do you have a few rules out not at all do you have a few rules out not at all do you have to remember any of the rules you don't to remember any of the rules you don't to remember any of the rules you don't have to apply these rules you don't even have to apply these rules you don't even have to apply these rules you don't even have to look at the PDF document in the have to look at the PDF document in the have to look at the PDF document in the um real ckss certification right but you um real ckss certification right but you um real ckss certification right but you should just be comfortable with the should just be comfortable with the should just be comfortable with the structure and you should know um how to structure and you should know um how to structure and you should know um how to apply a rule you know how to how to

apply a rule you know how to how to apply a rule you know how to how to maybe fix it like you you might be faced maybe fix it like you you might be faced maybe fix it like you you might be faced with a unsecure cluster you will be with a unsecure cluster you will be with a unsecure cluster you will be provided with some rules and then you provided with some rules and then you provided with some rules and then you have to to change and fix the have to to change and fix the have to to change and fix the cluster yeah um so you have to know cluster yeah um so you have to know cluster yeah um so you have to know Linux in the whole PDF you saw it was Linux in the whole PDF you saw it was Linux in the whole PDF you saw it was always structure right it was there was always structure right it was there was always structure right it was there was always a comment um how to check it and always a comment um how to check it and always a comment um how to check it and then an instruction how to fix it this then an instruction how to fix it this then an instruction how to fix it this could also be automated right this could also be automated right this could also be automated right this sounds like we don't have to even use a sounds like we don't have to even use a sounds like we don't have to even use a PDF document it sounds like this could PDF document it sounds like this could PDF document it sounds like this could be something that a program could do as be something that a program could do as be something that a program could do as well for us and yes that's right we will well for us and yes that's right we will well for us and yes that's right we will do this in the next section here we go cubench so that's section here we go cubench so that's what I was hoping it would be we will what I was hoping it would be we will what I was hoping it would be we will now use cubench run it on the master now use cubench run it on the master now use cubench run it on the master note and apply or check one rule and note and apply or check one rule and note and apply or check one rule and maybe fix it if it's not properly maybe fix it if it's not properly maybe fix it if it's not properly correctly configured right now what will correctly configured right now what will correctly configured right now what will we do okay we need to run Cube bench we do okay we need to run Cube bench we do okay we need to run Cube bench okay for this um just search Cube bench okay for this um just search Cube bench okay for this um just search Cube bench GitHub it should be the ACA security GitHub it should be the ACA security GitHub it should be the ACA security Cube bench Cube bench Cube bench repository and in there in the read me repository and in there in the read me repository and in there in the read me you see various methods of installing it you see various methods of installing it you see various methods of installing it of running it but look at running inside of running it but look at running inside of running it but look at running inside a container okay not installing from a a container okay not installing from a a container okay not installing from a container look at running inside a container look at running inside a container look at running inside a container and there you see a very container and there you see a very container and there you see a very simple Docker comment that you can run simple Docker comment that you can run simple Docker comment that you can run copy that comment head to your master copy that comment head to your master copy that comment head to your master not okay let's check it out cube bench I

not okay let's check it out cube bench I not okay let's check it out cube bench I think I might even have that already think I might even have that already think I might even have that already Cube cool okay so they've changed it a little cool okay so they've changed it a little bit here multiple ways to run CU bench here multiple ways to run CU bench inside a job yeah we'll try to mount a bunch of job yeah we'll try to mount a bunch of things I I don't think my Talos cluster things I I don't think my Talos cluster things I I don't think my Talos cluster will even allow this but it will be fun will even allow this but it will be fun will even allow this but it will be fun to test so let's see I'm going to go to to test so let's see I'm going to go to to test so let's see I'm going to go to my rencher desktop my rencher desktop my rencher desktop cluster and see what's going to happen cluster and see what's going to happen cluster and see what's going to happen if I run this um see make the um see make the bench bench bench bench bench bench and then V job yaml paste

see see okay so that works that's pretty okay so that works that's pretty okay so that works that's pretty [Music] cool 10 checks cool 10 checks fail cool so there it runs as a cool so there it runs as a job head there we head there we go run the blow command based on the F go run the blow command based on the F go run the blow command based on the F system on each worker node oh yeah pretty interesting so it just works yeah pretty interesting so it just works out of the box like that out of the box like that out of the box like that for for my rencher for for my rencher for for my rencher desktop after this I'm going to try it desktop after this I'm going to try it desktop after this I'm going to try it out on Talos see what out on Talos see what out on Talos see what happens and um here you see um you can happens and um here you see um you can happens and um here you see um you can actually um pass a parameter to the actually um pass a parameter to the actually um pass a parameter to the container and this is like master or container and this is like master or container and this is like master or node right so if you're on the master node right so if you're on the master node right so if you're on the master you want to check your master node you you want to check your master node you you want to check your master node you should pass master if you want to check should pass master if you want to check should pass master if you want to check your worker node you should pass not um your worker node you should pass not um your worker node you should pass not um type your version uh 1.19 I'll do and type your version uh 1.19 I'll do and type your version uh 1.19 I'll do and just run the comand okay you might I

just run the comand okay you might I just run the comand okay you might I mean in the real world you might want to mean in the real world you might want to mean in the real world you might want to install it like you don't have to do install it like you don't have to do install it like you don't have to do this you don't have to install Cube this you don't have to install Cube this you don't have to install Cube bench in the cks certification you will bench in the cks certification you will bench in the cks certification you will either be provided with it or you you either be provided with it or you you either be provided with it or you you will just be provided with the rules so will just be provided with the rules so will just be provided with the rules so we run it and we see a summary down here we run it and we see a summary down here we run it and we see a summary down here 43 checks passed 12 failed 10 warnings 43 checks passed 12 failed 10 warnings 43 checks passed 12 failed 10 warnings okay 12 failed let's have a look scroll okay 12 failed let's have a look scroll okay 12 failed let's have a look scroll up a little bit and here we see a nice up a little bit and here we see a nice up a little bit and here we see a nice colorful overview and we see one fail colorful overview and we see one fail colorful overview and we see one fail rule is rule is rule is 1.12 okay you could now also check in 1.12 okay you could now also check in 1.12 okay you could now also check in your um let's actually do it let's check your um let's actually do it let's check your um let's actually do it let's check the rule the rule the rule 1.1.2 in the PDF document that's the one ensure that the document that's the one ensure that the at CD data directory ownership is set to at CD data directory ownership is set to at CD data directory ownership is set to ET CD at CD doesn't seem like it is okay ET CD at CD doesn't seem like it is okay ET CD at CD doesn't seem like it is okay so so so auditing we can have a look we can run auditing we can have a look we can run auditing we can have a look we can run that that that comment comment comment and there we see right now it is at root and there we see right now it is at root and there we see right now it is at root root at least for me and that version root at least for me and that version root at least for me and that version that I'm using right now what can we do that I'm using right now what can we do that I'm using right now what can we do to fix it let's have a look to fix it let's have a look to fix it let's have a look recommendation okay I going to run this right let's simply add uh for testing uh right let's simply add uh for testing uh at CD user oh bad idea yeah you don't at CD user oh bad idea yeah you don't at CD user oh bad idea yeah you don't want to just add the user want to just add the user want to just add the user and if it's expecting to run as rout

and if it's expecting to run as rout and if it's expecting to run as rout then I wouldn't do then I wouldn't do then I wouldn't do this okay this seems to work I going to this okay this seems to work I going to this okay this seems to work I going to run the check command again and it is at run the check command again and it is at run the check command again and it is at CD at CD and now we can run the docker CD at CD and now we can run the docker CD at CD and now we can run the docker commment again so we run Q bench commment again so we run Q bench commment again so we run Q bench again and we see that 44 checks passed again and we see that 44 checks passed again and we see that 44 checks passed this looks better we scroll up and we this looks better we scroll up and we this looks better we scroll up and we can see that 1.1 12 the rule that we can see that 1.1 12 the rule that we can see that 1.1 12 the rule that we just checked pass now okay um yeah maybe just checked pass now okay um yeah maybe just checked pass now okay um yeah maybe you should be comfortable with Cube ADM you should be comfortable with Cube ADM you should be comfortable with Cube ADM like this uh maybe just pick another like this uh maybe just pick another like this uh maybe just pick another rule maybe also lock into your worker rule maybe also lock into your worker rule maybe also lock into your worker note and run the command then not with note and run the command then not with note and run the command then not with Master here but with note and maybe um Master here but with note and maybe um Master here but with note and maybe um fix the rule there as well on the on the fix the rule there as well on the on the fix the rule there as well on the on the ql for example ql for example ql for example okay well and yeah this shows you what okay well and yeah this shows you what okay well and yeah this shows you what Cube bench does it can check the rules Cube bench does it can check the rules Cube bench does it can check the rules automatically for you and based on this automatically for you and based on this automatically for you and based on this I don't know you could for example I don't know you could for example I don't know you could for example implement this in your continuous implement this in your continuous implement this in your continuous integration system or just send it to integration system or just send it to integration system or just send it to someone who should work and fix on these someone who should work and fix on these someone who should work and fix on these security issues and to finish this session um issues and to finish this session um just some remarks I would like to just some remarks I would like to just some remarks I would like to shortly show you the gcp CIS benchmarks shortly show you the gcp CIS benchmarks shortly show you the gcp CIS benchmarks so we can simply go to browser and um so we can simply go to browser and um so we can simply go to browser and um type in gcloud CS benchmarks and we see type in gcloud CS benchmarks and we see type in gcloud CS benchmarks and we see a page from Google actually a page from Google actually a page from Google actually cloud.google.com C benchmarks and on cloud.google.com C benchmarks and on cloud.google.com C benchmarks and on that page they explain a little bit and

that page they explain a little bit and that page they explain a little bit and if we scroll down then we actually see if we scroll down then we actually see if we scroll down then we actually see the um CIS benchmarks and the level and the um CIS benchmarks and the level and the um CIS benchmarks and the level and um if they passed or if they failed you um if they passed or if they failed you um if they passed or if they failed you know um and yeah and there you see what know um and yeah and there you see what know um and yeah and there you see what they actually apply in their um GK as they actually apply in their um GK as they actually apply in their um GK as well like the default values for their well like the default values for their well like the default values for their GK cluster okay so this is like really GK cluster okay so this is like really GK cluster okay so this is like really interesting really transparent AWS interesting really transparent AWS interesting really transparent AWS followed as well probably I don't know followed as well probably I don't know followed as well probably I don't know about Asia or others but they will about Asia or others but they will about Asia or others but they will probably follow as well let's find that probably follow as well let's find that probably follow as well let's find that out out out AKs assist Benchmark here we Benchmark here we [Music] go Yep this is the go Yep this is the entire the entire one the entire CIS Benchmark the entire one the entire CIS Benchmark for AKs so they also have it pretty it pretty cool if you are more interested there's cool if you are more interested there's cool if you are more interested there's a nice talk um by Martin white a nice talk um by Martin white a nice talk um by Martin white consistent security control so C consistent security control so C consistent security control so C benchmarks which explains it um a lot benchmarks which explains it um a lot benchmarks which explains it um a lot better the link is posted in the better the link is posted in the better the link is posted in the resources resources resources section there's also tool Docker bench section there's also tool Docker bench section there's also tool Docker bench if you're interested in it which um if you're interested in it which um if you're interested in it which um checks your Docker configuration I mean checks your Docker configuration I mean checks your Docker configuration I mean we will later touch on this as well we will later touch on this as well we will later touch on this as well because your kubernetes cluster is only

because your kubernetes cluster is only because your kubernetes cluster is only secure if your container runtime is secure if your container runtime is secure if your container runtime is secure itself we will work on on secure itself we will work on on secure itself we will work on on container level a bit more later so container level a bit more later so container level a bit more later so Docker bench might also be interesting Docker bench might also be interesting Docker bench might also be interesting not maybe not too interesting for the not maybe not too interesting for the not maybe not too interesting for the cks certification there it's more cks certification there it's more cks certification there it's more interesting to use Cube interesting to use Cube interesting to use Cube bench well and that's the end we learned bench well and that's the end we learned bench well and that's the end we learned what CS benchmarks are we learned how to what CS benchmarks are we learned how to what CS benchmarks are we learned how to use them with Cube bench like to check use them with Cube bench like to check use them with Cube bench like to check and we learned then based on the um CIS and we learned then based on the um CIS and we learned then based on the um CIS Benchmark recommendation to manually Benchmark recommendation to manually Benchmark recommendation to manually check and also to apply and fix and check and also to apply and fix and check and also to apply and fix and that's important for the certification that's important for the certification that's important for the certification to now okay now okay so um CS course see what's probably just Cube bench see what's probably just Cube bench right CIS CIS bench yeah it's just this one CIS bench yeah it's just this one CIS bench yeah it's just this one CIS benchmarks fixed control plane so he said you don't have to plane so he said you don't have to actually be running Cube bench actually be running Cube bench actually be running Cube bench apparently for the certification you apparently for the certification you apparently for the certification you will just be provided with some rules or maybe it does use Cube bench to

or maybe it does use Cube bench to ensure status pass which Cube bench yeah ensure status pass which Cube bench yeah ensure status pass which Cube bench yeah it's already it's already it's already installed so Cube bench bench um what if I just do um what if I just do um what if I just do Cube bench okay then it will just um show me okay then it will just um show me everything CBE bench and pipe that to vim and vim and [Music] 1.2.2 here fail ensure the profiling 1.2.2 here fail ensure the profiling argument is set to argument is set to argument is set to false edit the API server po false edit the API server po false edit the API server po specification file in ATC specification file in ATC specification file in ATC [Music] [Music] [Music] kubernetes okay okay [Music] [Music] [Music] so profiling equals false false viim so I'm going so I'm going to do that again but now I'm just going to do that again but now I'm just going to do that again but now I'm just going to open

t-mo t-mo and do the cube bench PPE that to Vim and do the cube bench PPE that to Vim and do the cube bench PPE that to Vim again open a new window in the again open a new window in the again open a new window in the meantime meantime meantime [Music] 1.2.2 1.2.2 here is the profiling equals here so there's nothing about profiling here so there's nothing about profiling here so then we here so then we here so then we just go just go just go down and add profiling equals again C could not connect to the

again C could not connect to the kubernetes server maybe it was restarting that pod server maybe it was restarting that pod after I changed the Manifest so 1.2.2 and now it's passing so that 1.2.2 and now it's passing so that worked so I'm going like it's it's going worked so I'm going like it's it's going worked so I'm going like it's it's going to it's going to pass now yeah to it's going to pass now yeah to it's going to pass now yeah validation successful but just to make validation successful but just to make validation successful but just to make sure that I fully understand what what sure that I fully understand what what sure that I fully understand what what is going on here cuz I was going a is going on here cuz I was going a is going on here cuz I was going a little bit quickly here little bit quickly here little bit quickly here [Music] 1.2.2 so we yeah okay I'm editing the 1.2.2 so we yeah okay I'm editing the actual manifest of the API server I set actual manifest of the API server I set actual manifest of the API server I set a parameter there and if I then do K get a parameter there and if I then do K get a parameter there and if I then do K get ps- ps- ps- a do I I see the API server here here API here here API server the API server has been restarted server the API server has been restarted server the API server has been restarted 50 seconds ago and that would um correspond with the change I just um correspond with the change I just made that's interesting this this thing made that's interesting this this thing made that's interesting this this thing has has been running for 28 days has has been running for 28 days has has been running for 28 days apparently so this this killer Koda in

apparently so this this killer Koda in apparently so this this killer Koda in the back end probably has a bunch of the back end probably has a bunch of the back end probably has a bunch of PODS running running and then people PODS running running and then people PODS running running and then people connect to them and then they get connect to them and then they get connect to them and then they get restarted after they are uh finished restarted after they are uh finished restarted after they are uh finished with the scenario I think that's what it with the scenario I think that's what it with the scenario I think that's what it means I assume this runs in a kubernetes means I assume this runs in a kubernetes means I assume this runs in a kubernetes cluster well anyway scenario solved cluster well anyway scenario solved cluster well anyway scenario solved let's just check out let's just check out let's just check out the results oh they actually did run the results oh they actually did run the results oh they actually did run targets master I just did CU bench I only added this profiling one and it I only added this profiling one and it it it fixed it it fixed it it fixed it okay well as long as it's it okay well as long as it's it okay well as long as it's fixed okay how much is left on my Pomodoro oh okay how much is left on my Pomodoro oh eight minutes well before I start the eight minutes well before I start the eight minutes well before I start the next session maybe I do a few questions next session maybe I do a few questions next session maybe I do a few questions here from the chat Amisha just wanted to here from the chat Amisha just wanted to here from the chat Amisha just wanted to thank you for the content you appeared thank you for the content you appeared thank you for the content you appeared exactly the right time for me well thank exactly the right time for me well thank exactly the right time for me well thank you Oliver that's nice to hear if you you Oliver that's nice to hear if you you Oliver that's nice to hear if you have free time can you have free time can you have free time can you post a separate video how to set up

post a separate video how to set up post a separate video how to set up devops related tools for more devops related tools for more devops related tools for more productivity in productivity in productivity in Mac well that's a very broad question Mac well that's a very broad question Mac well that's a very broad question devops related devops related devops related tools um I have this one what is one and tools um I have this one what is one and tools um I have this one what is one and a half hour long video about the tools I a half hour long video about the tools I a half hour long video about the tools I use and yeah if you want to learn how to use and yeah if you want to learn how to use and yeah if you want to learn how to set them up I recommend you take a look set them up I recommend you take a look set them up I recommend you take a look at my school at my school at my school Community there you can ask me questions Community there you can ask me questions Community there you can ask me questions directly ly and uh I can help you with directly ly and uh I can help you with directly ly and uh I can help you with setting them setting them setting them up thanks for the content right now I'm up thanks for the content right now I'm up thanks for the content right now I'm getting ready for the cka exam so happy getting ready for the cka exam so happy getting ready for the cka exam so happy you can keep me company yeah that's nice you can keep me company yeah that's nice you can keep me company yeah that's nice I'm uh happy that we can study I'm uh happy that we can study I'm uh happy that we can study together did you do the cka D together did you do the cka D together did you do the cka D certification no I have don't have that certification no I have don't have that certification no I have don't have that one yet I have the cka I did that uh or one yet I have the cka I did that uh or one yet I have the cka I did that uh or it's almost two years ago now I did the it's almost two years ago now I did the it's almost two years ago now I did the cka and then started working with cka and then started working with cka and then started working with kubernetes every day and I'm doing the kubernetes every day and I'm doing the kubernetes every day and I'm doing the cks and I plan when I get the cks that's cks and I plan when I get the cks that's cks and I plan when I get the cks that's when I'll do the ckad exam because I've when I'll do the ckad exam because I've when I'll do the ckad exam because I've heard that if you have the cka then the heard that if you have the cka then the heard that if you have the cka then the ckad D is um piece of cake or it's a lot ckad D is um piece of cake or it's a lot ckad D is um piece of cake or it's a lot easier so easier so easier so um I'll just get that to get the full um I'll just get that to get the full um I'll just get that to get the full Trio of cka ckad and cks but first I Trio of cka ckad and cks but first I Trio of cka ckad and cks but first I need to get the need to get the need to get the cks I wonder what the next topic is cks I wonder what the next topic is cks I wonder what the next topic is going to going to going to be verify platform binaries oh there's

be verify platform binaries oh there's be verify platform binaries oh there's our answer verify platform our answer verify platform our answer verify platform binaries I have about six minutes left binaries I have about six minutes left binaries I have about six minutes left of my Pomodoro so this seems to be about 6 minutes so so this seems to be about 6 minutes so I'll just start start with this and then I'll just start start with this and then I'll just start start with this and then take a break and I'll be we will shortly take a break and I'll be we will shortly take a break and I'll be we will shortly talk about hashes then we will download talk about hashes then we will download talk about hashes then we will download and verify some kubernetes binaries and and verify some kubernetes binaries and and verify some kubernetes binaries and finally we do the same from a kubernetes finally we do the same from a kubernetes finally we do the same from a kubernetes binary running inside a binary running inside a binary running inside a container well if we have a file and we container well if we have a file and we container well if we have a file and we want to validate it we want to check want to validate it we want to check want to validate it we want to check that it's actually the file from the that it's actually the file from the that it's actually the file from the original Source what we can do is we can original Source what we can do is we can original Source what we can do is we can create some kind of a fingerprint of create some kind of a fingerprint of create some kind of a fingerprint of that file right and a fingerprint of a that file right and a fingerprint of a that file right and a fingerprint of a file would then be called a hash there file would then be called a hash there file would then be called a hash there are different algorithms like sha or md5 are different algorithms like sha or md5 are different algorithms like sha or md5 you probably have heard about these you probably have heard about these you probably have heard about these These are kind of these are oneway These are kind of these are oneway These are kind of these are oneway algorithms so it means from a file you algorithms so it means from a file you algorithms so it means from a file you can calculate the hash but from a hash can calculate the hash but from a hash can calculate the hash but from a hash you can't calculate the file back okay you can't calculate the file back okay you can't calculate the file back okay so it's kind of a compression algorithm so it's kind of a compression algorithm so it's kind of a compression algorithm and a loss for compression and a loss for compression and a loss for compression algorithm and yeah so what we can do to algorithm and yeah so what we can do to algorithm and yeah so what we can do to verify platform binaries which will do verify platform binaries which will do verify platform binaries which will do on the example of kubernetes is to check on the example of kubernetes is to check on the example of kubernetes is to check the hash value which is provided from the hash value which is provided from the hash value which is provided from The Trusted original source with the The Trusted original source with the The Trusted original source with the hash value that we create of the file we will now download a kubernetes file we will now download a kubernetes release from GitHub and then verify the

release from GitHub and then verify the release from GitHub and then verify the downloaded files what you should do is downloaded files what you should do is downloaded files what you should do is you should head to your master note you you should head to your master note you you should head to your master note you should do Cube CDL get notes and then should do Cube CDL get notes and then should do Cube CDL get notes and then you should check the kuties version that you should check the kuties version that you should check the kuties version that you are running I'm using 11 191 you you are running I'm using 11 191 you you are running I'm using 11 191 you might use a later version depending on might use a later version depending on might use a later version depending on which version we have in the course which version we have in the course which version we have in the course install scripts right now so remember install scripts right now so remember install scripts right now so remember that version and then head to github.com that version and then head to github.com that version and then head to github.com kubernetes when ities okay so on there kubernetes when ities okay so on there kubernetes when ities okay so on there you should see releases or you can see you should see releases or you can see you should see releases or you can see here the here the here the text and if you click on text what you text and if you click on text what you text and if you click on text what you can do is simply open any tag release can do is simply open any tag release can do is simply open any tag release and then on top you can simply replace and then on top you can simply replace and then on top you can simply replace it you see what I do here I replace it it you see what I do here I replace it it you see what I do here I replace it with with with 1191 and there you go this is my release 1191 and there you go this is my release 1191 and there you go this is my release version and then down here we see version and then down here we see version and then down here we see additional binary downloads are linked additional binary downloads are linked additional binary downloads are linked in the change lock change in the change lock change in the change lock change lock so click on lock so click on lock so click on there okay here we have the client there okay here we have the client there okay here we have the client binaries which are for example the cuet binaries which are for example the cuet binaries which are for example the cuet and then we have the server binaries and and then we have the server binaries and and then we have the server binaries and we would like to download the server we would like to download the server we would like to download the server binaries okay so here we see the server binaries okay so here we see the server binaries okay so here we see the server binary file um amd64 server Linux and binary file um amd64 server Linux and binary file um amd64 server Linux and here we actually see already a sha 512 here we actually see already a sha 512 here we actually see already a sha 512 hash which we would compare after hash which we would compare after hash which we would compare after downloading the file so copy the link downloading the file so copy the link downloading the file so copy the link head to your master note download head to your master note download head to your master note download it there we go okay downloaded the file

it there we go okay downloaded the file it there we go okay downloaded the file we have it here now what can we do to we have it here now what can we do to we have it here now what can we do to compare the hash value right we saw it's compare the hash value right we saw it's compare the hash value right we saw it's hash uh sha 512 and that should be by hash uh sha 512 and that should be by hash uh sha 512 and that should be by default sh 512 some Comm let's see do I default sh 512 some Comm let's see do I default sh 512 some Comm let's see do I have that have that have that sh 52 some okay so I have that on every sh 52 some okay so I have that on every sh 52 some okay so I have that on every Linux machine so we can just call it um Linux machine so we can just call it um Linux machine so we can just call it um pass the file pass the file pass the file name and there we go we see the name and there we go we see the name and there we go we see the generated hash what can we do now to generated hash what can we do now to generated hash what can we do now to compare these hatches well we can have a compare these hatches well we can have a compare these hatches well we can have a short look with our eyes and say right short look with our eyes and say right short look with our eyes and say right now I check the beginning I check the now I check the beginning I check the now I check the beginning I check the end yes it looks fine but um we can also end yes it looks fine but um we can also end yes it looks fine but um we can also do it a bit more thoroughly so what I do it a bit more thoroughly so what I do it a bit more thoroughly so what I usually do is I pass the output in a new usually do is I pass the output in a new usually do is I pass the output in a new file file file compare head into the new file compare head into the new file compare head into the new file and let me remove me for a second and and let me remove me for a second and and let me remove me for a second and here on uh top right I'll just edit so I here on uh top right I'll just edit so I here on uh top right I'll just edit so I only want to have the hash in that file only want to have the hash in that file only want to have the hash in that file right so I remove the rest of it oh man right so I remove the rest of it oh man right so I remove the rest of it oh man D dollar sign D dollar sign and you D dollar sign D dollar sign and you D dollar sign D dollar sign and you delete until the end of the line and delete until the end of the line and delete until the end of the line and then I head to github.com to The Trusted then I head to github.com to The Trusted then I head to github.com to The Trusted source and copy that hash paste it in source and copy that hash paste it in source and copy that hash paste it in and yes it looks very similar it looks and yes it looks very similar it looks and yes it looks very similar it looks fine but what we can also do is uh we fine but what we can also do is uh we fine but what we can also do is uh we simply output simply output simply output the compare file there we see both lines the compare file there we see both lines the compare file there we see both lines and then we pipe it into unic and then and then we pipe it into unic and then and then we pipe it into unic and then it only displays uni lines and then we

it only displays uni lines and then we it only displays uni lines and then we see yes it only displays one which means see yes it only displays one which means see yes it only displays one which means these two are uni so what we did right these two are uni so what we did right these two are uni so what we did right now is we now is we now is we downloaded yeah okay I understand downloaded yeah okay I understand downloaded yeah okay I understand this now it gets really interesting this now it gets really interesting this now it gets really interesting because now we want to compare the API because now we want to compare the API because now we want to compare the API server binary running inside our server binary running inside our server binary running inside our container with the one that we container with the one that we container with the one that we downloaded for this we are on our master downloaded for this we are on our master downloaded for this we are on our master nodee control plane and we downloaded nodee control plane and we downloaded nodee control plane and we downloaded the kubernetes server well it's time for the kubernetes server well it's time for the kubernetes server well it's time for my break so I'm going to continue with my break so I'm going to continue with my break so I'm going to continue with this in about 10 minutes um I wrote some this in about 10 minutes um I wrote some this in about 10 minutes um I wrote some sort of script for a break scripts uh what's it called break start scripts uh what's it called break start break what does it break what does it break what does it do will return When pomor reaches 40 do will return When pomor reaches 40 do will return When pomor reaches 40 minutes so I'll do Pomo and we're back from the

and we're back from the break time to do another 50 minutes Pomo we'll have done two hour Pomo we'll have done two hour sessions or a 2hour session of studying sessions or a 2hour session of studying sessions or a 2hour session of studying today and after that I'm going to visit today and after that I'm going to visit today and after that I'm going to visit some family because it's Easter some family because it's Easter some family because it's Easter so Pomo start another 50 minutes let's start another 50 minutes let's go go go binaries and we should extract binaries and we should extract binaries and we should extract these which can take a little these which can take a little these which can take a little bit because in some they're actually bit because in some they're actually bit because in some they're actually quite large and in that extracted large and in that extracted folder folder folder we can actually have a we can actually have a we can actually have a look in the server directory bin look in the server directory bin look in the server directory bin directory and there we see for example directory and there we see for example directory and there we see for example the API server binary controller manager the API server binary controller manager the API server binary controller manager Etc Etc Etc so we need to make sure to be able to so we need to make sure to be able to so we need to make sure to be able to compare this now that we have the proper compare this now that we have the proper compare this now that we have the proper version right so what we can actually do version right so what we can actually do version right so what we can actually do is we can is we can is we can simply simply simply run the cube API server binary attach run the cube API server binary attach run the cube API server binary attach version and we see I'm using version version and we see I'm using version version and we see I'm using version 1.22 do2 and I'm using that version 1.22 do2 and I'm using that version 1.22 do2 and I'm using that version because in my cluster on my master not because in my cluster on my master not because in my cluster on my master not right now that version is also running

right now that version is also running right now that version is also running how can we find this out how can we find this out how can we find this out well in the cube system well in the cube system well in the cube system namespace there should be a pot running namespace there should be a pot running namespace there should be a pot running for the API server there we go it's for the API server there we go it's for the API server there we go it's running as a static pod via Cube ADM running as a static pod via Cube ADM running as a static pod via Cube ADM manifest and if we have a manifest and if we have a manifest and if we have a look at what image it's running then we actually see okay I'm running then we actually see okay I'm also running right now version 1. also running right now version 1. also running right now version 1. 122.2mi ahead and compare the two 122.2mi ahead and compare the two 122.2mi ahead and compare the two binaries first we should probably get binaries first we should probably get binaries first we should probably get the hush of the downloaded binary from the hush of the downloaded binary from the hush of the downloaded binary from GitHub for this we can just simply run GitHub for this we can just simply run GitHub for this we can just simply run the Sha 500 TR the Sha 500 TR the Sha 500 TR sum there we go and what I do is I write sum there we go and what I do is I write sum there we go and what I do is I write it into a new file it into a new file it into a new file compare now we need for the comparison compare now we need for the comparison compare now we need for the comparison we need to have the Sham of the binary we need to have the Sham of the binary we need to have the Sham of the binary running in inside the container right so running in inside the container right so running in inside the container right so what can we do well we can try to EXA what can we do well we can try to EXA what can we do well we can try to EXA into the shell doesn't seem to shell doesn't seem to work we try to get a bash doesn't seem work we try to get a bash doesn't seem work we try to get a bash doesn't seem to work okay so these containers of the to work okay so these containers of the to work okay so these containers of the kubernetes components can be considered kubernetes components can be considered kubernetes components can be considered hardened already because they don't even hardened already because they don't even hardened already because they don't even include a shell they're probably kind of include a shell they're probably kind of include a shell they're probably kind of started From Scratch and only the actual

started From Scratch and only the actual started From Scratch and only the actual binaries um pre-compiled from goang are binaries um pre-compiled from goang are binaries um pre-compiled from goang are actually in that container and run so actually in that container and run so actually in that container and run so it's like really it's like really it's like really minimalistic so what can we do well we minimalistic so what can we do well we minimalistic so what can we do well we know that the API server is running as a know that the API server is running as a know that the API server is running as a pot on the on our node on which we are pot on the on our node on which we are pot on the on our node on which we are right now so we can have a look using right now so we can have a look using right now so we can have a look using Cree TL and there we see it's running here TL and there we see it's running here which means we should also see the which means we should also see the which means we should also see the processes from that container oh yeah and there we go there container oh yeah and there we go there we actually see the cube API server we actually see the cube API server we actually see the cube API server process and what we also see is the PID process and what we also see is the PID process and what we also see is the PID of the process it might be a different of the process it might be a different of the process it might be a different PID for you right using this P we can PID for you right using this P we can PID for you right using this P we can now actually access the file system now actually access the file system now actually access the file system through the proc directory so what what through the proc directory so what what through the proc directory so what what we can do is we have a look into proc we can do is we have a look into proc we can do is we have a look into proc then the P ID of our process and then in then the P ID of our process and then in then the P ID of our process and then in the root directory and there we see the the root directory and there we see the the root directory and there we see the actual the root file system of the actual the root file system of the actual the root file system of the container so what can we do well let's container so what can we do well let's container so what can we do well let's search the whole root directory and look search the whole root directory and look search the whole root directory and look for the cube API for the cube API for the cube API server and there we have server and there we have server and there we have it so we can simply generate the sh sum it so we can simply generate the sh sum it so we can simply generate the sh sum for this for this for this one good luck doing that on uh one good luck doing that on uh one good luck doing that on uh AKs and append it to our compare fire AKs and append it to our compare fire AKs and append it to our compare fire now let's have a look at the compare

now let's have a look at the compare now let's have a look at the compare file just from me looking at it it looks file just from me looking at it it looks file just from me looking at it it looks like it's the like it's the like it's the same value it's this well done sir same same value it's this well done sir same same value it's this well done sir same hush which pretty good but I can also go hush which pretty good but I can also go hush which pretty good but I can also go ahead and clean this up a little ahead and clean this up a little ahead and clean this up a little bit remove the and if we compare time as the well this was a pretty short but for the well this was a pretty short but for me interesting section we learned what me interesting section we learned what me interesting section we learned what hashes on the 12 container um this might hashes on the 12 container um this might hashes on the 12 container um this might be a bit outside of the scope of the Cs be a bit outside of the scope of the Cs be a bit outside of the scope of the Cs but well you never know what will be but well you never know what will be but well you never know what will be happen right okay so it's outside of scope but right okay so it's outside of scope but it's pretty fun so I'm I'm I'm going to it's pretty fun so I'm I'm I'm going to it's pretty fun so I'm I'm I'm going to do the scenario um okay F successful I'm going to do um okay F successful I'm going to do this this this scenario but I'm going to put more time scenario but I'm going to put more time scenario but I'm going to put more time into that but it was pretty cool how he into that but it was pretty cool how he into that but it was pretty cool how he was uh checking out was uh checking out was uh checking out the for finding the container using the the for finding the container using the the for finding the container using the proc file system let me see was it hash is that the one uh that we need to hash is that the one uh that we need to do check the cubet binary hash I think do check the cubet binary hash I think do check the cubet binary hash I think that's the that's the that's the one actually should one actually should one actually should [Music] [Music] [Music] go go go um

I think I think I cloned it right yeah CD killer sh ckss course course and scenarios MD there setup secure Ingress CIS MD there setup secure Ingress CIS Benchmark verify platform binaries Benchmark verify platform binaries Benchmark verify platform binaries that's that's that's it veriform verifi platform binaries c it veriform verifi platform binaries c it veriform verifi platform binaries c yeah that's the yeah that's the yeah that's the one when the YouTuber you watch for one when the YouTuber you watch for one when the YouTuber you watch for devops content to learn watches Another devops content to learn watches Another devops content to learn watches Another YouTuber for dev's content to learn yeah YouTuber for dev's content to learn yeah YouTuber for dev's content to learn yeah well that's how I learn right I I have well that's how I learn right I I have well that's how I learn right I I have to gain the knowledge myself in order to to gain the knowledge myself in order to to gain the knowledge myself in order to transfer it to transfer it to transfer it to others others others that's a fun comment thank you okay oh in the same version as the okay oh in the same version as the installed one okay sure so we have installed one okay sure so we have installed one okay sure so we have to uh first figure out what the version to uh first figure out what the version to uh first figure out what the version is well we do that is well we do that is well we do that by by by um K

um K um K get get get pod n Cube pod n Cube pod n Cube system and then Cube system and then Cube system and then Cube API server control API server control API server control plane output that as plane output that as plane output that as yo and then grab image 1290 well man set- o 1290 well man set- o VI so much better better [Music] 1 1 29 that's zero zero downloading the downloading the downloading the binary then compare binary then compare binary then compare their sha hashes and answer with cubet and I'll have to get the cubet and I'll have to get the Sha 512 sum of

Sha 512 sum of Sha 512 sum of user in oh that's taking a long time to oh that's taking a long time to load okay but I think that should be okay but I think that should be it because the CU blet is actually a it because the CU blet is actually a it because the CU blet is actually a binary running on the on the thing but binary running on the on the thing but binary running on the on the thing but it was pretty cool how it was figuring it was pretty cool how it was figuring it was pretty cool how it was figuring out let's see if I can do the same uh out let's see if I can do the same uh out let's see if I can do the same uh about the qabi server so so was it right 3ct LPS scrap right 3ct LPS scrap API this is the API API this is the API API this is the API server so PS Al GP server so PS Al GP server so PS Al GP API yeah here is the API yeah here is the API yeah here is the process running Cube API process running Cube API process running Cube API server so if I go to CD server so if I go to CD server so if I go to CD proc here is the that's pretty cool here proc here is the that's pretty cool here proc here is the that's pretty cool here is the root file system of that

was okay yeah sure I have the root file was okay yeah sure I have the root file system but what is the binary then CD system but what is the binary then CD system but what is the binary then CD root here is root here is root here is the thing CD lib how did he get the binary then where lib how did he get the binary then where was the binary in the container file I'm in the file syst how did he get the I'm in the file syst how did he get the the binary from there process and then the binary from there process and then the binary from there process and then in the root directory and there we see in the root directory and there we see in the root directory and there we see the actual the root file system of the the actual the root file system of the the actual the root file system of the container so what can we do well let's container so what can we do well let's container so what can we do well let's search the whole root directory and look search the whole root directory and look search the whole root directory and look yeah okay okay [Music] [Music] [Music] so I'm in root and then so I'm in root and then so I'm in root and then find find find dot grab API here user local B Cube API server API here user local B Cube API server there is the binary cool has this one there is the binary cool has this one there is the binary cool has this one downloaded yet still not 10% scenario what is the next scenario going

scenario what is the next scenario going to be cluster hardening arback oh okay to be cluster hardening arback oh okay to be cluster hardening arback oh okay yeah yeah yeah so I'm familiar with arback but I've so I'm familiar with arback but I've so I'm familiar with arback but I've heard heard heard that the exam actually has a lot of that the exam actually has a lot of that the exam actually has a lot of questions on network policies and arbac questions on network policies and arbac questions on network policies and arbac so what I'm doing now is I'm I'm so what I'm doing now is I'm I'm so what I'm doing now is I'm I'm practicing Network policies every day I practicing Network policies every day I practicing Network policies every day I really want to get it into the in my really want to get it into the in my really want to get it into the in my fingers in my memory that I don't have fingers in my memory that I don't have fingers in my memory that I don't have to think about those on the exam and to think about those on the exam and to think about those on the exam and from what I've heard like I've spoken to from what I've heard like I've spoken to from what I've heard like I've spoken to a few people who have recently taken the a few people who have recently taken the a few people who have recently taken the exam that like maybe half of the points exam that like maybe half of the points exam that like maybe half of the points you can score by knowing Network you can score by knowing Network you can score by knowing Network policies and are back well so those are policies and are back well so those are policies and are back well so those are those are easy points right it's not those are easy points right it's not those are easy points right it's not hard um you just have to like it's hard hard um you just have to like it's hard hard um you just have to like it's hard if you haven't done it for a few weeks if you haven't done it for a few weeks if you haven't done it for a few weeks you know the mechanics but you have to you know the mechanics but you have to you know the mechanics but you have to sort of look it up and really think sort of look it up and really think sort of look it up and really think through it but that's what I'm going to through it but that's what I'm going to through it but that's what I'm going to be be be practicing uh every day so that I have practicing uh every day so that I have practicing uh every day so that I have those sort of in the muscle memory and those sort of in the muscle memory and those sort of in the muscle memory and readily available in my mind and then I readily available in my mind and then I readily available in my mind and then I can can quickly score points so I'm can can quickly score points so I'm can can quickly score points so I'm happy that I'm finally getting to the happy that I'm finally getting to the happy that I'm finally getting to the rback module because then I can start rback module because then I can start rback module because then I can start practicing that every day too so our practicing that every day too so our practicing that every day too so our binary is finally have the binary and it is actually a

have the binary and it is actually a zipped one so I'll have to unzip it I um oh how do I do that um oh how do I do that again he did that too right he on he on unzip oh it's downloading the entire oh it's downloading the entire kubernetes um Cube ADM kubernetes um Cube ADM kubernetes um Cube ADM binaries binaries binaries aha aha aha okay kubernetes and then in here there okay kubernetes and then in here there okay kubernetes and then in here there should be the cuet so find dot grab should be the cuet so find dot grab should be the cuet so find dot grab cuet CD cuet CD cuet CD server cuet that is this one and now I'm going

cuet that is this one and now I'm going to do that redirect that to my MD and MD and then Vim Su MD oh MD oh oops I should have appended that and yes o yes o script no it's just uh which cuet and then sha 52 cuet and then sha 52 sum user bin okay so here is the file and they are okay so here is the file and they are actually different they are actually different so different they are actually different so then I can do Echo

then I can do Echo then I can do Echo different to answer different to answer different to answer and then this should be the right answer and then this should be the right answer and then this should be the right answer validation successful validation successful validation successful yay so let's check if how they do it downloads ah interesting I I actually downloads ah interesting I I actually got the version from the API got the version from the API got the version from the API server but he is doing it from the cuet so cuet so Echo yeah yeah basically the same name and I yeah yeah basically the same name and I got the right solution okay cool that got the right solution okay cool that got the right solution okay cool that was fun so let's move on to the next one was fun so let's move on to the next one was fun so let's move on to the next one roll based access roll based access roll based access control it is boring and annoying but control it is boring and annoying but control it is boring and annoying but very important to know and it's going to very important to know and it's going to very important to know and it's going to be uh scoring me a lot of points on the be uh scoring me a lot of points on the be uh scoring me a lot of points on the exam so let's get to exam so let's get to exam so let's get to it Ro based Access Control very it Ro based Access Control very it Ro based Access Control very important very big topic I hope you're

important very big topic I hope you're important very big topic I hope you're ready I'm definitely ready ready I'm definitely ready ready I'm definitely ready we will first talk about Ro based access we will first talk about Ro based access we will first talk about Ro based access control and I will explain it to you control and I will explain it to you control and I will explain it to you simply and Visually afterwards we will simply and Visually afterwards we will simply and Visually afterwards we will create a few scenarios and we also work create a few scenarios and we also work create a few scenarios and we also work with certificates and with certificates and with certificates and users role based exit control is a users role based exit control is a users role based exit control is a general concept of regulating access to general concept of regulating access to general concept of regulating access to computer or network resources based on computer or network resources based on computer or network resources based on the roles of individual users within the roles of individual users within the roles of individual users within your organization kubernetes has it as your organization kubernetes has it as your organization kubernetes has it as well since early versions and it's well since early versions and it's well since early versions and it's enabled via the authorization mode enabled via the authorization mode enabled via the authorization mode string it's def default always allow but string it's def default always allow but string it's def default always allow but there's also the RO based access control there's also the RO based access control there's also the RO based access control which is if you have a cube ADM cluster which is if you have a cube ADM cluster which is if you have a cube ADM cluster it's enabled by it's enabled by it's enabled by default so we can use it to restrict default so we can use it to restrict default so we can use it to restrict access to resources when accessed by access to resources when accessed by access to resources when accessed by users or service accounts and we will users or service accounts and we will users or service accounts and we will talk about users and service accounts talk about users and service accounts talk about users and service accounts later as well but we will work with we later as well but we will work with we later as well but we will work with we always work with roles and role bindings always work with roles and role bindings always work with roles and role bindings and you always specify what is allowed and you always specify what is allowed and you always specify what is allowed and everything else is denied so you and everything else is denied so you and everything else is denied so you Whit list what is allowed Whit list what is allowed Whit list what is allowed there's no deny rules in robas Access there's no deny rules in robas Access there's no deny rules in robas Access Control in Control in Control in kubernetes only access data or that's an kubernetes only access data or that's an kubernetes only access data or that's an important note so I'm going to open my important note so I'm going to open my important note so I'm going to open my kubernetes kubernetes kubernetes note and let's create a new one called orback orback and uh um the note I want to create is

and uh um the note I want to create is and uh um the note I want to create is there are no default denies in denies in kubernetes farb kubernetes farb kubernetes farb back so how did he phrase that we will back so how did he phrase that we will back so how did he phrase that we will work with we always work with roles and work with we always work with roles and work with we always work with roles and Ro bindings and you always specify what Ro bindings and you always specify what Ro bindings and you always specify what is allowed and everything else is denied is allowed and everything else is denied is allowed and everything else is denied so you Whit list what is allowed there's so you Whit list what is allowed there's so you Whit list what is allowed there's no deny rules in Rob oh okay I got that no deny rules in Rob oh okay I got that no deny rules in Rob oh okay I got that wrong there are no deny rules in rback wrong there are no deny rules in rback wrong there are no deny rules in rback you only SP everything is you only SP everything is you only SP everything is denied yeah there are no denied yeah there are no denied yeah there are no deny rules in kubernetes RB back there are no deny rules in back there are no deny rules in kubernetes RB back Access Control in kubernetes RB back Access Control in kubernetes RB back Access Control in kubernetes no deny and everything else kubernetes no deny and everything else kubernetes no deny and everything else is denied so you Whit list what is is denied so you Whit list what is is denied so you Whit list what is allowed allowed allowed there's no deny rules in world base there's no deny rules in world base there's no deny rules in world base Access Control in kubernetes yeah so to put it in my own kubernetes yeah so to put it in my own words it is only possible to allow words it is only possible to allow words it is only possible to allow permissions in kubernetes you can kubernetes you can only white list only white list only white list it's a bit different from how he he said it's a bit different from how he he said it's a bit different from how he he said it but that's what why what I'm doing

it but that's what why what I'm doing it but that's what why what I'm doing right I'm doing the settle cast method right I'm doing the settle cast method right I'm doing the settle cast method so I'm just making a small atomic note so I'm just making a small atomic note so I'm just making a small atomic note and uh this is all I want to note for and uh this is all I want to note for and uh this is all I want to note for that so I'll move that to the zp that so I'll move that to the zp that so I'll move that to the zp directory and going back to my rback directory and going back to my rback directory and going back to my rback this is also a note that I want this is also a note that I want this is also a note that I want to publish and to publish and to publish and now uh in 20 minutes this is going to be now uh in 20 minutes this is going to be now uh in 20 minutes this is going to be published on my public settle cast you published on my public settle cast you published on my public settle cast you can check that out here this is my can check that out here this is my can check that out here this is my website um I have a Blog but I also have website um I have a Blog but I also have website um I have a Blog but I also have a public settle a public settle a public settle cast and here you can see that cast and here you can see that cast and here you can see that um like here this morning I added a note um like here this morning I added a note um like here this morning I added a note about adding container images to Ranch about adding container images to Ranch about adding container images to Ranch your desktop and pulling them and here your desktop and pulling them and here your desktop and pulling them and here is the is the is the kubernetes um map of content so there kubernetes um map of content so there kubernetes um map of content so there will be a new thing appearing here about will be a new thing appearing here about will be a new thing appearing here about arback in about 30 minutes then it will arback in about 30 minutes then it will arback in about 30 minutes then it will publish it automatically so you can you publish it automatically so you can you publish it automatically so you can you can follow along with my studies um in can follow along with my studies um in can follow along with my studies um in my zcast and I'm publishing all of the my zcast and I'm publishing all of the my zcast and I'm publishing all of the notes here as I go along only access data or information along only access data or information that is necessary for the legitimate that is necessary for the legitimate that is necessary for the legitimate purpose so it's kind of the principle of purpose so it's kind of the principle of purpose so it's kind of the principle of Le least privilege which should always Le least privilege which should always Le least privilege which should always be in the back of our minds when we be in the back of our minds when we be in the back of our minds when we Define a role based Access Control Define a role based Access Control Define a role based Access Control rules yeah that's that's always in in rules yeah that's that's always in in rules yeah that's that's always in in Cloud engineering infrastructure

Cloud engineering infrastructure Cloud engineering infrastructure engineering it's always the principle of engineering it's always the principle of engineering it's always the principle of leas leas leas privilege and let's talk about Nam privilege and let's talk about Nam privilege and let's talk about Nam spaced and non-name spaced resources spaced and non-name spaced resources spaced and non-name spaced resources before we jump into the role based before we jump into the role based before we jump into the role based Access Control resources so kubernetes Access Control resources so kubernetes Access Control resources so kubernetes has names spaced and non-name spaced has names spaced and non-name spaced has names spaced and non-name spaced resources we can actually look at them resources we can actually look at them resources we can actually look at them um if we run Cube CTL API resources and um if we run Cube CTL API resources and um if we run Cube CTL API resources and then the names space parameter true or then the names space parameter true or then the names space parameter true or false namespace resources are for false namespace resources are for false namespace resources are for example pods non-name space resources example pods non-name space resources example pods non-name space resources are for example nodes or persistent are for example nodes or persistent are for example nodes or persistent volumes yeah and um yeah if we look at volumes yeah and um yeah if we look at volumes yeah and um yeah if we look at Ro based access control then there we Ro based access control then there we Ro based access control then there we also have the namespaced role and the also have the namespaced role and the also have the namespaced role and the non-name space cluster role okay and the non-name space cluster role okay and the non-name space cluster role okay and the role and the cluster role they Define a role and the cluster role they Define a role and the cluster role they Define a set of permissions and the set of set of permissions and the set of set of permissions and the set of permissions can be can edit pots can permissions can be can edit pots can permissions can be can edit pots can read Secrets okay yeah I remember this read Secrets okay yeah I remember this read Secrets okay yeah I remember this from the Ka exam so we Define a set of from the Ka exam so we Define a set of from the Ka exam so we Define a set of permissions then we have Ro binding and permissions then we have Ro binding and permissions then we have Ro binding and cluster role binding and with these cluster role binding and with these cluster role binding and with these bindings we Define who gets a set of bindings we Define who gets a set of bindings we Define who gets a set of permissions like bind a role or cluster permissions like bind a role or cluster permissions like bind a role or cluster role to something or someone yeah and role to something or someone yeah and role to something or someone yeah and it's always bound to service it's always bound to service it's always bound to service accounts so when we look at roles to accounts so when we look at roles to accounts so when we look at roles to describe them we could ask the questions describe them we could ask the questions describe them we could ask the questions where are the permissions available okay where are the permissions available okay where are the permissions available okay so we Define a set of permissions so we Define a set of permissions so we Define a set of permissions and we say where it is available like and we say where it is available like and we say where it is available like when we Define a role then we Define a when we Define a role then we Define a when we Define a role then we Define a set of permissions which is available in

set of permissions which is available in set of permissions which is available in one Nam space if we Define a cluster rle one Nam space if we Define a cluster rle one Nam space if we Define a cluster rle then we Define a set of permissions then we Define a set of permissions then we Define a set of permissions which is available in all Nam spaces and which is available in all Nam spaces and which is available in all Nam spaces and also globally in the also globally in the also globally in the cluster okay when we go to the right cluster okay when we go to the right cluster okay when we go to the right side with the bindings then we can ask side with the bindings then we can ask side with the bindings then we can ask the questions where is a set of the questions where is a set of the questions where is a set of permissions applied because if we use a permissions applied because if we use a permissions applied because if we use a role binding then it's applied in one role binding then it's applied in one role binding then it's applied in one names space if we use a cluster role names space if we use a cluster role names space if we use a cluster role binding finding then it's applied in all binding finding then it's applied in all binding finding then it's applied in all Nam Nam Nam spaces using these four resources there spaces using these four resources there spaces using these four resources there are various combinations of these and we are various combinations of these and we are various combinations of these and we will get into the valid combinations um will get into the valid combinations um will get into the valid combinations um just in a few slides ahead let's have a look at a role like ahead let's have a look at a role like like an example role we call it secret like an example role we call it secret like an example role we call it secret manager and it is in namespace blue manager and it is in namespace blue manager and it is in namespace blue right under rules we have resources so right under rules we have resources so right under rules we have resources so this is about secrets this is about secrets this is about secrets and we are allowed to get watch and list and we are allowed to get watch and list and we are allowed to get watch and list Secrets now we create a second rle which Secrets now we create a second rle which Secrets now we create a second rle which is very similar it's also called secret is very similar it's also called secret is very similar it's also called secret manager but it's available in namespace manager but it's available in namespace manager but it's available in namespace red okay we have one in namespace blue red okay we have one in namespace blue red okay we have one in namespace blue one in namespace red and the one in one in namespace red and the one in one in namespace red and the one in namespace red allows less it only allows namespace red allows less it only allows namespace red allows less it only allows us to get Secrets whereas the other one us to get Secrets whereas the other one us to get Secrets whereas the other one allows us to get watch and list secrets allows us to get watch and list secrets allows us to get watch and list secrets so using this we have the same role we so using this we have the same role we so using this we have the same role we have the same same role with the same have the same same role with the same have the same same role with the same name secret manager in two Nam spaces name secret manager in two Nam spaces name secret manager in two Nam spaces but in every Nam space um it allows

but in every Nam space um it allows but in every Nam space um it allows different it has different permissions different it has different permissions different it has different permissions it allows us to have different actions it allows us to have different actions it allows us to have different actions right so a user yeah it's an entirely right so a user yeah it's an entirely right so a user yeah it's an entirely different resource it's an entirely different resource it's an entirely different resource it's an entirely different resource and because they're different resource and because they're different resource and because they're in the different name spaces then they in the different name spaces then they in the different name spaces then they can also have the same name can be can also have the same name can be can also have the same name can be secret manager in multiple namespaces secret manager in multiple namespaces secret manager in multiple namespaces but the permissions are different in but the permissions are different in but the permissions are different in each each each namespace now let's look at at the namespace now let's look at at the namespace now let's look at at the example when using a cluster role now we example when using a cluster role now we example when using a cluster role now we have a cluster role secret manager have a cluster role secret manager have a cluster role secret manager instead of a role as before and it instead of a role as before and it instead of a role as before and it allows us to get allows us to get allows us to get Secrets as you see there's no namespace Secrets as you see there's no namespace Secrets as you see there's no namespace in a cluster role because it's a nonn in a cluster role because it's a nonn in a cluster role because it's a nonn namespace namespace namespace resource and this would allow us then a resource and this would allow us then a resource and this would allow us then a user can be secret manager in multiple user can be secret manager in multiple user can be secret manager in multiple namespaces but the permissions are the namespaces but the permissions are the namespaces but the permissions are the same in every same in every same in every namespace namespace namespace okay this just as like two examples to okay this just as like two examples to okay this just as like two examples to example usages between a row and a example usages between a row and a example usages between a row and a cluster row if we look at a cluster role then we row if we look at a cluster role then we have to be careful right we should be have to be careful right we should be have to be careful right we should be careful with cluster roles and cluster careful with cluster roles and cluster careful with cluster roles and cluster Ro bindings because they apply to all Ro bindings because they apply to all Ro bindings because they apply to all current and future namespaced and non-n current and future namespaced and non-n current and future namespaced and non-n namespaced resources if you have three namespaced resources if you have three namespaced resources if you have three namespaces and you say yes my user namespaces and you say yes my user namespaces and you say yes my user should have access to all these three should have access to all these three should have access to all these three name spaces then you can create a name spaces then you can create a name spaces then you can create a cluster on a cluster Ro binding but you cluster on a cluster Ro binding but you cluster on a cluster Ro binding but you you should be aware that as as soon as you should be aware that as as soon as you should be aware that as as soon as you add a new name space in the future you add a new name space in the future you add a new name space in the future the user having that cluster roll and the user having that cluster roll and the user having that cluster roll and cluster roll binding will automatically cluster roll binding will automatically cluster roll binding will automatically get access to that namespace created in

get access to that namespace created in get access to that namespace created in the future so be careful with cluster the future so be careful with cluster the future so be careful with cluster roles we now look at combinations okay roles we now look at combinations okay roles we now look at combinations okay we again have our four resources for we again have our four resources for we again have our four resources for robas Access Control we have a role we robas Access Control we have a role we robas Access Control we have a role we have a cluster role we have a r binding have a cluster role we have a r binding have a cluster role we have a r binding we have a cluster rooll binding how can we have a cluster rooll binding how can we have a cluster rooll binding how can we combine these okay we remember a r we combine these okay we remember a r we combine these okay we remember a r defines a set of defines a set of defines a set of per that that set of permissions is per that that set of permissions is per that that set of permissions is applied in a single name space okay this applied in a single name space okay this applied in a single name space okay this works another combination available in works another combination available in works another combination available in the user has that set of permissions in the user has that set of permissions in the user has that set of permissions in all permissions is applied in all Nam all permissions is applied in all Nam all permissions is applied in all Nam spaces yeah set of permissions in one or spaces yeah set of permissions in one or spaces yeah set of permissions in one or in a few name spaces right because the in a few name spaces right because the in a few name spaces right because the set of permission is available in all set of permission is available in all set of permission is available in all Nam spaces but we just apply it maybe in Nam spaces but we just apply it maybe in Nam spaces but we just apply it maybe in one names space or in two Nam Space by one names space or in two Nam Space by one names space or in two Nam Space by creating a row binding in all these name creating a row binding in all these name creating a row binding in all these name spaces oh that's interesting so you can spaces oh that's interesting so you can spaces oh that's interesting so you can have a cluster have a cluster have a cluster Ro which is available in all Nam spaces Ro which is available in all Nam spaces Ro which is available in all Nam spaces but if you only create a ro binding in but if you only create a ro binding in but if you only create a ro binding in in a namespace it has the same permissions in namespace it has the same permissions in multiple namespaces well well is name is name is name spaces set of permissions is available spaces set of permissions is available spaces set of permissions is available in all Nam spaces set of permissions is

in all Nam spaces set of permissions is in all Nam spaces set of permissions is applied in all Nam spaces another combination is we still spaces another combination is we still have a cluster role set of permissions have a cluster role set of permissions have a cluster role set of permissions available in all names available in all names available in all names spaces we now apply it just in one or in spaces we now apply it just in one or in spaces we now apply it just in one or in a few name spaces right because the set a few name spaces right because the set a few name spaces right because the set of permission is available in all of permission is available in all of permission is available in all namespaces but we just apply it maybe in namespaces but we just apply it maybe in namespaces but we just apply it maybe in one namespace or in two namespace by one namespace or in two namespace by one namespace or in two namespace by creating a row binding in all these Nam creating a row binding in all these Nam creating a row binding in all these Nam spaces yeah okay so that was was spaces yeah okay so that was was spaces yeah okay so that was was confusing me so when you create a role confusing me so when you create a role confusing me so when you create a role binding in one Nam space then it will binding in one Nam space then it will binding in one Nam space then it will only apply these permissions in that only apply these permissions in that only apply these permissions in that namespace but you can do it in multiple namespace but you can do it in multiple namespace but you can do it in multiple ones that's what he's saying here so ones that's what he's saying here so ones that's what he's saying here so this comment here confused me but you this comment here confused me but you this comment here confused me but you can have a cluster rle that is available can have a cluster rle that is available can have a cluster rle that is available in all namespaces so you get all of the in all namespaces so you get all of the in all namespaces so you get all of the permissions and if you have a cross the permissions and if you have a cross the permissions and if you have a cross the roll binding then it's available to all roll binding then it's available to all roll binding then it's available to all namespaces but if namespaces but if namespaces but if you assign the role biding only to that you assign the role biding only to that you assign the role biding only to that namespace even though it is a cluster namespace even though it is a cluster namespace even though it is a cluster role it will only apply to that role it will only apply to that role it will only apply to that namespace so going to write a note on that I so going to write a note on that I think cluster cluster roles can be applied to single name

roll is roll is available to the entire available to the entire available to the entire cluster but you will cluster but you will cluster but you will only receive the these permissions in only receive the these permissions in only receive the these permissions in all name all name all name spaces if a spaces if a spaces if a [Music] [Music] [Music] cluster roll binding is cluster roll binding is cluster roll binding is created you can also create a create a normal roll binding which is a nam normal roll binding which is a nam normal roll binding which is a nam spaced resource then resource then the the the permissions will only apply to that name permissions will only apply to that name permissions will only apply to that name space even though it is a cluster rule can rule can also you can also have roll bindings also you can also have roll bindings also you can also have roll bindings from multiple names from multiple names from multiple names spaces and the spaces and the spaces and the cluster rule will only apply to those cluster rule will only apply to those cluster rule will only apply to those name name name spaces yeah can be applied to single to

yeah can be applied to single to one one or more name spaces let's clean it up a bit spaces let's clean it up a bit cluster cluster roll roll cluster R bindings created created yeah publish well is there another combination can we well is there another combination can we create or combine a role with a cluster create or combine a role with a cluster create or combine a role with a cluster rooll binding no we can't do this why rooll binding no we can't do this why rooll binding no we can't do this why well because a role defines a set of well because a role defines a set of well because a role defines a set of permissions which is only available in permissions which is only available in permissions which is only available in one one one namespace and if it's only available in namespace and if it's only available in namespace and if it's only available in one namespace then we can't apply it to one namespace then we can't apply it to one namespace then we can't apply it to all Nam spaces using a cluster Ro line all Nam spaces using a cluster Ro line all Nam spaces using a cluster Ro line so these are the three combinations so these are the three combinations so these are the three combinations which are possible which are possible which are possible permissions are additive which means um permissions are additive which means um permissions are additive which means um we always specify what is allowed we always specify what is allowed we always specify what is allowed everything else is denied so we white everything else is denied so we white everything else is denied so we white list and permissions are additive which list and permissions are additive which list and permissions are additive which means let's have a look at a simple means let's have a look at a simple means let's have a look at a simple example okay let's say we have a cluster example okay let's say we have a cluster example okay let's say we have a cluster role and a cluster Ro binding which role and a cluster Ro binding which role and a cluster Ro binding which allows us to get and delete allows us to get and delete allows us to get and delete Secrets then we Define for the same user

Secrets then we Define for the same user Secrets then we Define for the same user we Define a role and a role binding in a we Define a role and a role binding in a we Define a role and a role binding in a certain name space which only allows to certain name space which only allows to certain name space which only allows to get get get Secrets okay the result will be that the Secrets okay the result will be that the Secrets okay the result will be that the user is able to get and delete secrets user is able to get and delete secrets user is able to get and delete secrets in that namespace in that namespace in that namespace so even if for one namespace here we so even if for one namespace here we so even if for one namespace here we Define stricter role bindings or Define stricter role bindings or Define stricter role bindings or stricter rules R best access control stricter rules R best access control stricter rules R best access control rules it doesn't restrict them right rules it doesn't restrict them right rules it doesn't restrict them right because as soon as the user has to get because as soon as the user has to get because as soon as the user has to get and delete Secrets as soon as he is and delete Secrets as soon as he is and delete Secrets as soon as he is allowed to do this you you can't create allowed to do this you you can't create allowed to do this you you can't create more restrictive rols afterwards always test your robot access afterwards always test your robot access control rules just a reminder never control rules just a reminder never control rules just a reminder never never trust your uh your your skills never trust your uh your your skills never trust your uh your your skills just like that always verify we will do just like that always verify we will do just like that always verify we will do this in your hands on create a short this in your hands on create a short this in your hands on create a short notes on that as notes on that as notes on that as well power back well power back well power back um permissions are additive additive permissions from permissions from permissions from cluster roll bindings and roll bindings cluster roll bindings and roll bindings cluster roll bindings and roll bindings will be added sessions and with that I would

added sessions and with that I would say added to each other let's move let's move on we will now create a first simple on we will now create a first simple on we will now create a first simple scenario we will create two Nam spaces scenario we will create two Nam spaces scenario we will create two Nam spaces red and blue and we have a user Jane and red and blue and we have a user Jane and red and blue and we have a user Jane and that user Jane should be secret manager that user Jane should be secret manager that user Jane should be secret manager in namespace red and blue but it will in namespace red and blue but it will in namespace red and blue but it will have different permissions in each so have different permissions in each so have different permissions in each so user Jane can only get secrets in user Jane can only get secrets in user Jane can only get secrets in namespace red and user Jane can only get namespace red and user Jane can only get namespace red and user Jane can only get and list secrets in namespace blue and and list secrets in namespace blue and and list secrets in namespace blue and we will test it okay so I'm going it okay so I'm going to do to do to do this in my Rancher desktop cluster okay create NS red okay create cluster okay create NS red okay create finess finess finess blue you using of can I okay we should blue you using of can I okay we should blue you using of can I okay we should be on our Master note cluster ready as be on our Master note cluster ready as be on our Master note cluster ready as always first we will create the always first we will create the always first we will create the namespaces namespaces namespaces red and the namespaces the namespace red and the namespaces the namespace red and the namespaces the namespace blue there we blue there we blue there we go now user Jane can only get secrets in go now user Jane can only get secrets in go now user Jane can only get secrets in namespace red okay for this we will namespace red okay for this we will namespace red okay for this we will create a rle and a role binding okay

create a rle and a role binding okay create a rle and a role binding okay whenever you have to create a role and a whenever you have to create a role and a whenever you have to create a role and a role binding Bing cluster roll cluster R role binding Bing cluster roll cluster R role binding Bing cluster roll cluster R binding in ckss you should be binding in ckss you should be binding in ckss you should be comfortable just using Cube CTL don't go comfortable just using Cube CTL don't go comfortable just using Cube CTL don't go copy a roll from some some y place from copy a roll from some some y place from copy a roll from some some y place from the dock and then try toedit it right the dock and then try toedit it right the dock and then try toedit it right just gener faster like just gener faster like just gener faster like this so in namespace red Jane can only this so in namespace red Jane can only this so in namespace red Jane can only get get get secrets so we create a secrets so we create a secrets so we create a row we name it row we name it row we name it secret manager and we specif manager and we specif y the verb only get and the resource is y the verb only get and the resource is y the verb only get and the resource is Secrets I will print out the yaml now Secrets I will print out the yaml now Secrets I will print out the yaml now just for us to just for us to just for us to see and there we see we will create a see and there we see we will create a see and there we see we will create a role um it called secret manager in role um it called secret manager in role um it called secret manager in namespace red and resources secrets and namespace red and resources secrets and namespace red and resources secrets and verbs get great let's create and now we will create a ro binding to and now we will create a ro binding to the user Jane So Ro binding is the user Jane So Ro binding is the user Jane So Ro binding is namespaced in the same namespace red namespaced in the same namespace red namespaced in the same namespace red recreate a r binding recall it as well recreate a r binding recall it as well recreate a r binding recall it as well secret secret secret manager we specify the manager we specify the manager we specify the role re the role is secret manager and role re the role is secret manager and role re the role is secret manager and then we specify the user the user is then we specify the user the user is then we specify the user the user is chain again for now I will do a dry run

chain again for now I will do a dry run chain again for now I will do a dry run for us to inspect this we create a role binding it will be it we create a role binding it will be it will bind the role secret manager to the will bind the role secret manager to the will bind the role secret manager to the user chain that's what we want exactly this okay what else do we want to do this okay what else do we want to do before we start uh to test and to verify before we start uh to test and to verify before we start uh to test and to verify our our skills user Jane can only get our our skills user Jane can only get our our skills user Jane can only get and list secrets in namespace and list secrets in namespace and list secrets in namespace blue okay so kind of the same thing for blue okay so kind of the same thing for blue okay so kind of the same thing for namespace row but in names space blue create R we row but in names space blue create R we call it secret manager as well oops I I call it secret manager as well oops I I call it secret manager as well oops I I messed up here okay get Ru okay delete Ro okay delete Ro binding secret binding secret binding secret manager cuz I made a manager cuz I made a manager cuz I made a [Music] typo here we go should be here then then typo here we go should be here then then is get and we write another verb list is get and we write another verb list is get and we write another verb list because we say get and list secrets in because we say get and list secrets in because we say get and list secrets in namespace

blue blue so then it is KM blue create R secret is KM blue create R secret manager get get and list km list km [Music] blue create Ro secret manager verb blue create Ro secret manager verb is get is get is get list resource is client there we go and then we as well client there we go and then we as well create a row binding also called secret create a row binding also called secret create a row binding also called secret manager manager manager in k in k in k n blue n blue n blue create role binding rooll is secret binding rooll is secret [Music] [Music] [Music] manager user is blue and that should be it the commons

blue and that should be it the commons by the way you should be very by the way you should be very by the way you should be very comfortable with typing these and fast comfortable with typing these and fast comfortable with typing these and fast um but they're also in the resources um but they're also in the resources um but they're also in the resources section of this video yeah okay that's section of this video yeah okay that's section of this video yeah okay that's what I'm going to be training on so what I'm going to be training on so what I'm going to be training on so there is K Cube C there is K Cube C there is K Cube C of k of k of k i okay and as always the help page i okay and as always the help page i okay and as always the help page already shows many useful examples already shows many useful examples already shows many useful examples we now want to test in namespace red can we now want to test in namespace red can we now want to test in namespace red can I get Secrets as user see off can I see off can I yes yes yes okay oh I remember this K red off can I okay oh I remember this K red off can I okay oh I remember this K red off can I get Secrets as Jane get Secrets as Jane get Secrets as Jane yes and then in yeah yes I can do it can I do it as user yeah yes I can do it can I do it as user Tom Tom Tom no can I can I delete no can I can I delete no can I can I delete Secrets as user Jane in namespace red no Secrets as user Jane in namespace red no Secrets as user Jane in namespace red no can I list Secrets as user Jane in NIS can I list Secrets as user Jane in NIS can I list Secrets as user Jane in NIS red no but I should be able to list red no but I should be able to list red no but I should be able to list secrets in namespace blue as user Jane secrets in namespace blue as user Jane secrets in namespace blue as user Jane and I should be able to get Secrets user and I should be able to get Secrets user and I should be able to get Secrets user Jane right and um let's see can I list

Secrets s Secrets s Jane In namespace Jane In namespace Jane In namespace Bloom oh no rle secret manager Bloom oh no rle secret manager Bloom oh no rle secret manager found okay create Ro forgot to create the role um what Ro forgot to create the role um what about other things can I can I get pots about other things can I can I get pots about other things can I can I get pots as user Jane no right because we defined as user Jane no right because we defined as user Jane no right because we defined that one set of permissions that the that one set of permissions that the that one set of permissions that the user is only able to do user is only able to do user is only able to do and us can only get and list secrets in and us can only get and list secrets in and us can only get and list secrets in namespace blue so then it should be k n namespace blue so then it should be k n namespace blue so then it should be k n blue create Ro secret blue create Ro secret blue create Ro secret manager manager manager verb verb verb is get list resource is list resource is secret okay and then now secret okay and then now secret okay and then now K and K and K and blue I everything else that can I get pods as I everything else that can I get pods as user Jan no right get pod as chane no

user Jan no right get pod as chane no user Jan no right get pod as chane no can can can I list I list I list secrets yes okay now it works because we secrets yes okay now it works because we secrets yes okay now it works because we defined that one set of permissions that defined that one set of permissions that defined that one set of permissions that the user is only able to do and the user is only able to do and the user is only able to do and everything else is denied we will now create another denied we will now create another scenario or extend the existing scenario scenario or extend the existing scenario scenario or extend the existing scenario by creating a cluster rle one cluster R by creating a cluster rle one cluster R by creating a cluster rle one cluster R binding and one role binding and we binding and one role binding and we binding and one role binding and we introduce JY to the game what will we do introduce JY to the game what will we do introduce JY to the game what will we do well we will create one cluster role well we will create one cluster role well we will create one cluster role deploy deleter which allows to delete deploy deleter which allows to delete deploy deleter which allows to delete deployments then we create or we allow deployments then we create or we allow deployments then we create or we allow Jane to delete deployments in all names Jane to delete deployments in all names Jane to delete deployments in all names spaces so we create a cluster Ro binding spaces so we create a cluster Ro binding spaces so we create a cluster Ro binding then for user JY we allow to only delete then for user JY we allow to only delete then for user JY we allow to only delete deployments in namespace Red so we will deployments in namespace Red so we will deployments in namespace Red so we will create a r binding and we will test create a r binding and we will test create a r binding and we will test everything using of kis before first everything using of kis before first everything using of kis before first thing let's create a cluster roll deploy thing let's create a cluster roll deploy thing let's create a cluster roll deploy deleter which allows to delete deleter which allows to delete deleter which allows to delete deployments K create cluster deployments K create cluster deployments K create cluster roll DH always helpful right we see roll DH always helpful right we see roll DH always helpful right we see various examples but it's the same thing various examples but it's the same thing various examples but it's the same thing as if we create a role as we did before as if we create a role as we did before as if we create a role as we did before so we specify a ver which means delete so we specify a ver which means delete so we specify a ver which means delete and a and a and a resource which will be

deployments and we have to give the deployments and we have to give the cluster rer name so we call it deploy cluster rer name so we call it deploy cluster rer name so we call it deploy deleter right that's what we want to deleter right that's what we want to deleter right that's what we want to call it deploy deleter correct there we call it deploy deleter correct there we call it deploy deleter correct there we go it's created let's move on user Jane go it's created let's move on user Jane go it's created let's move on user Jane can delete deployments in all Nam spaces can delete deployments in all Nam spaces can delete deployments in all Nam spaces so we now for user Jane create a cluster so we now for user Jane create a cluster so we now for user Jane create a cluster roll binding for that cluster roll okay roll binding for that cluster roll okay roll binding for that cluster roll okay create cluster roll binding create create cluster roll binding create create cluster roll binding create cluster roll cluster roll cluster roll binding we call it deploy deleter if it binding we call it deploy deleter if it binding we call it deploy deleter if it is for is for is for user user user Jane and we specify the cluster Jane and we specify the cluster Jane and we specify the cluster row row row deploy deleter there we go you have to deploy deleter there we go you have to deploy deleter there we go you have to Cluster roll not Cluster roll not Cluster roll not roll next user gym can delete roll next user gym can delete roll next user gym can delete deployments only in namespace deployments only in namespace deployments only in namespace red uh create cluster roll delete and then if I go k delete and then if I go k off can I delete deployment in the deployment in the namespace zle cast or namespace melee

Jane what was it so we will create a ro Jane what was it so we will create a ro binding in namespace red for that binding in namespace red for that binding in namespace red for that cluster rle okay in namespace red create row rle okay in namespace red create row binding we call it deploy deleter for binding we call it deploy deleter for binding we call it deploy deleter for user user user gym and for cluster gym and for cluster gym and for cluster role deploy role deploy role deploy deleter there you go okay let's test deleter there you go okay let's test deleter there you go okay let's test what we did here what we did here what we did here okay let's test for user Jane in okay let's test for user Jane in okay let's test for user Jane in namespace default or let's let's just namespace default or let's let's just namespace default or let's let's just create the one 4K and red create R findinding deploy deleter users findinding deploy deleter users gym cluster gym cluster gym cluster roll deploy deleter let's first with without any deleter let's first with without any name spaces K off can I delete name spaces K off can I delete name spaces K off can I delete deployments deployments deployments as as as Jane yes I can yep can I do it in all Jane yes I can yep can I do it in all Jane yes I can yep can I do it in all name spaces yes I can can I do it in the name spaces yes I can can I do it in the name spaces yes I can can I do it in the default Nam space yes can I do it in the default Nam space yes can I do it in the default Nam space yes can I do it in the red Nam space yes can I delete pods no

red Nam space yes can I delete pods no red Nam space yes can I delete pods no right it's great Jane can delete right it's great Jane can delete right it's great Jane can delete deployments in all Nam deployments in all Nam deployments in all Nam spaces how does it look for user gy can spaces how does it look for user gy can spaces how does it look for user gy can user user user gym delete delete deployments in the gym delete delete deployments in the gym delete delete deployments in the default Nam space no can use the gym default Nam space no can use the gym default Nam space no can use the gym delete deployments in all Nam spaces no delete deployments in all Nam spaces no delete deployments in all Nam spaces no can use a gym delete namespaces delete can use a gym delete namespaces delete can use a gym delete namespaces delete deployments in namespace red yes no deployments in namespace red yes no deployments in namespace red yes no there we go okay you should get familiar there we go okay you should get familiar there we go okay you should get familiar with these maybe look also at the yl with these maybe look also at the yl with these maybe look also at the yl that's generated by the comments but that's generated by the comments but that's generated by the comments but usually if you have to create rolls roll usually if you have to create rolls roll usually if you have to create rolls roll bindings cluster roles cluster roll bindings cluster roles cluster roll bindings cluster roles cluster roll bindings it's very easy to do this using bindings it's very easy to do this using bindings it's very easy to do this using cctl and then to test it using Cube CTL cctl and then to test it using Cube CTL cctl and then to test it using Cube CTL as as as well and the comments that we used in well and the comments that we used in well and the comments that we used in the section are also in the resources of the section are also in the resources of the section are also in the resources of this video have to create rolls roll bindings video have to create rolls roll bindings so that's the end of this Pomodoro it is so that's the end of this Pomodoro it is so that's the end of this Pomodoro it is now 10:30 and I'm debating whether I now 10:30 and I'm debating whether I now 10:30 and I'm debating whether I should continue or not should continue or not should continue or not uh I'm going to family after this and I uh I'm going to family after this and I uh I'm going to family after this and I need to do a few chores before I leave need to do a few chores before I leave need to do a few chores before I leave so it feels a bit dumb to end it in the so it feels a bit dumb to end it in the so it feels a bit dumb to end it in the middle of the rback module though um yeah I think I have another Pomodoro

um yeah I think I have another Pomodoro in me I think I'm going to not do the in me I think I'm going to not do the in me I think I'm going to not do the entire one but I do want to finish this entire one but I do want to finish this entire one but I do want to finish this module and I'll have to just um do by module and I'll have to just um do by module and I'll have to just um do by chores this evening so I'm going to take chores this evening so I'm going to take chores this evening so I'm going to take a break and then I'll um continue with a break and then I'll um continue with a break and then I'll um continue with another partial and we're back going to keep going for

and we're back going to keep going for about half an hour or about half an hour or about half an hour or so and so and so and um then I'll go and have brunch with the family cluster rolls cluster roll family cluster rolls cluster roll bindings it's very easy to do this using bindings it's very easy to do this using bindings it's very easy to do this using Cube CTL and then to test it using Cube Cube CTL and then to test it using Cube Cube CTL and then to test it using Cube CTL as CTL as CTL as well and the comments that we used in well and the comments that we used in well and the comments that we used in this section are also in the resources this section are also in the resources this section are also in the resources of this video we will now talk about accounts in video we will now talk about accounts in kubernetes so accounts in kubernetes kubernetes so accounts in kubernetes kubernetes so accounts in kubernetes there are service accounts and quote there are service accounts and quote there are service accounts and quote normal users service accounts are used normal users service accounts are used normal users service accounts are used usually by machines like pots to access usually by machines like pots to access usually by machines like pots to access the kubernetes API and service accounts the kubernetes API and service accounts the kubernetes API and service accounts are actually managed by kubernetes API are actually managed by kubernetes API are actually managed by kubernetes API which means there is a service account which means there is a service account which means there is a service account resource in kubernetes that can be resource in kubernetes that can be resource in kubernetes that can be created edited deleted for normal users created edited deleted for normal users created edited deleted for normal users this is not the case there is no this is not the case there is no this is not the case there is no kubernetes user resource a user is kubernetes user resource a user is kubernetes user resource a user is simply someone who holds a certificate simply someone who holds a certificate simply someone who holds a certificate and this is done so that outside and this is done so that outside and this is done so that outside Services can easily integrate with the Services can easily integrate with the Services can easily integrate with the kubernetes identity management so the kubernetes identity management so the kubernetes identity management so the identity management of cloud providers identity management of cloud providers identity management of cloud providers like AWS or Google Cloud simply have to like AWS or Google Cloud simply have to like AWS or Google Cloud simply have to issue certificates and to store and issue certificates and to store and issue certificates and to store and manage certificates and keys and can manage certificates and keys and can manage certificates and keys and can then use these to communicate with the then use these to communicate with the then use these to communicate with the kubernetes kubernetes

kubernetes API so what is a normal user in API so what is a normal user in API so what is a normal user in kubernetes there is no kubernetes user kubernetes there is no kubernetes user kubernetes there is no kubernetes user resource a user is someone with a resource a user is someone with a resource a user is someone with a certificate and key so if we have a user certificate and key so if we have a user certificate and key so if we have a user certificate a client certificate that it certificate a client certificate that it certificate a client certificate that it has to be signed by the certificate has to be signed by the certificate has to be signed by the certificate authority of the kubernetes cluster and authority of the kubernetes cluster and authority of the kubernetes cluster and we will see how it's done in the next we will see how it's done in the next we will see how it's done in the next slide and in that client certificate slide and in that client certificate slide and in that client certificate there will be the CN the common name there will be the CN the common name there will be the CN the common name entry and if it's set to Jane then the entry and if it's set to Jane then the entry and if it's set to Jane then the username is Jane and if you then send a username is Jane and if you then send a username is Jane and if you then send a request to the commun API containing request to the commun API containing request to the commun API containing that certificate then you will register that certificate then you will register that certificate then you will register you will be able to execute comments you will be able to execute comments you will be able to execute comments under the user Jane and under the under the user Jane and under the under the user Jane and under the permissions that the user Jane permissions that the user Jane permissions that the user Jane has how can we get a certificate signed has how can we get a certificate signed has how can we get a certificate signed from kubernetes okay so the procedure from kubernetes okay so the procedure from kubernetes okay so the procedure would be would be would be first we will have to have a certificate so that's really interesting certificate so that's really interesting I was thinking about it while I was I was thinking about it while I was I was thinking about it while I was having my break like we were assigning having my break like we were assigning having my break like we were assigning it to users but how how are the users it to users but how how are the users it to users but how how are the users actually defined so I'm going to write a couple defined so I'm going to write a couple of notes here um service nonhumans used for in cluster

nonhumans used for in cluster [Music] [Music] [Music] controllers Etc how did he explain that managed by Etc how did he explain that managed by kuber quote have to create to do the in kuber quote have to create to do the in kuber quote have to create to do the in the resource we will now talk about the resource we will now talk about the resource we will now talk about accounts and quote normal users service accounts and quote normal users service accounts and quote normal users service accounts are used usually by machines accounts are used usually by machines accounts are used usually by machines like pots to access the kubernetes API like pots to access the kubernetes API like pots to access the kubernetes API and service accounts are actually and service accounts are actually and service accounts are actually managed by kubernetes API which means managed by kubernetes API which means managed by kubernetes API which means there is a service account resource in there is a service account resource in there is a service account resource in kubernetes that can be created edited kubernetes that can be created edited kubernetes that can be created edited deleted deleted deleted yeah R cluster controllers PS um managed by the managed by the kubernetes kubernetes kubernetes API and lives in the cluster as a API and lives in the cluster as a API and lives in the cluster as a resource so if I go to k get service resource so if I go to k get service resource so if I go to k get service account in all Nam spaces I see a bunch account in all Nam spaces I see a bunch account in all Nam spaces I see a bunch of service of service of service accounts and if I do K accounts and if I do K accounts and if I do K get service get service get service account uh n Cube account uh n Cube account uh n Cube system and let's call take the helm system and let's call take the helm system and let's call take the helm traffic traffic traffic one and up with the as one and up with the as one and up with the as yaml here I can see the service account yaml here I can see the service account yaml here I can see the service account here with token token yeah interesting there are

yeah interesting there are yeah interesting there are also okay get service account I'm also seeing here that every account I'm also seeing here that every Nam space gets a default service account Nam space gets a default service account Nam space gets a default service account okay get service okay get service okay get service account namespace mely default and up account namespace mely default and up account namespace mely default and up put that as put that as put that as yo each each Nam Space by default gets a yo each each Nam Space by default gets a yo each each Nam Space by default gets a service account I didn't know that service account I didn't know that service account I didn't know that that's interesting makes sense though because interesting makes sense though because then everything in that namespace can be then everything in that namespace can be then everything in that namespace can be authorized to do certain things it's authorized to do certain things it's authorized to do certain things it's really really really cool but so the service account are only cool but so the service account are only cool but so the service account are only used by nonhumans used for in-cluster used by nonhumans used for in-cluster used by nonhumans used for in-cluster controllers pods and managed by the controllers pods and managed by the controllers pods and managed by the kubernetes API and lives in the cluster kubernetes API and lives in the cluster kubernetes API and lives in the cluster as a as a as a resource so that's ready for resource so that's ready for resource so that's ready for publication and publication and publication and then users do not live in the cluster as users do not live in the cluster as resources that's really resources that's really resources that's really important important important there is no there is no there is no [Music] user resource in user resource in kubernetes for normal users this is not kubernetes for normal users this is not kubernetes for normal users this is not the case there is no kubernetes user the case there is no kubernetes user the case there is no kubernetes user resource a user is simply someone who

resource a user is simply someone who resource a user is simply someone who holds a certificate and this is users holds a certificate and this is users holds a certificate and this is users users are authorized by users are authorized by users are authorized by the ls certificates so that outside certificates so that outside Services can easily integrate with the Services can easily integrate with the Services can easily integrate with the kubernetes identity management so the kubernetes identity management so the kubernetes identity management so the identity management of cloud providers identity management of cloud providers identity management of cloud providers like AWS or Google Cloud simply have to like AWS or Google Cloud simply have to like AWS or Google Cloud simply have to issue certificates and to store and issue certificates and to store and issue certificates and to store and manage certificates and keys and can manage certificates and keys and can manage certificates and keys and can then use these to communicate with the then use these to communicate with the then use these to communicate with the kubernetes kubernetes kubernetes API so yeah so how that works in in AKs API so yeah so how that works in in AKs API so yeah so how that works in in AKs is that um you have entra ID and those is that um you have entra ID and those is that um you have entra ID and those those are users and then they can be those are users and then they can be those are users and then they can be authorized to get the credentials and authorized to get the credentials and authorized to get the credentials and when they do then it is actually linked when they do then it is actually linked when they do then it is actually linked to your entra ID your your your user ID to your entra ID your your your user ID to your entra ID your your your user ID so what is a normal user in kubernetes so what is a normal user in kubernetes so what is a normal user in kubernetes there is no kubernetes user resource a there is no kubernetes user resource a there is no kubernetes user resource a user is someone with a certificate and user is someone with a certificate and user is someone with a certificate and key so if we have a user certificate a key so if we have a user certificate a key so if we have a user certificate a client client client certificate certificate certificate okay okay okay move move move that and just for fun let's see if the that and just for fun let's see if the that and just for fun let's see if the other new notes were already published other new notes were already published other new notes were already published refresh yeah here so here on my website refresh yeah here so here on my website refresh yeah here so here on my website zettle cast. Misha venberg zettle cast. Misha venberg zettle cast. Misha venberg Donnet you can see that the notes that I Donnet you can see that the notes that I Donnet you can see that the notes that I was adding just now like RB permissions

was adding just now like RB permissions was adding just now like RB permissions are additive these are all now available are additive these are all now available are additive these are all now available on my zel cast so every time I move them on my zel cast so every time I move them on my zel cast so every time I move them to the zp directory in obsidian Acron to the zp directory in obsidian Acron to the zp directory in obsidian Acron job handles it and it will be published job handles it and it will be published job handles it and it will be published so you can actually see all of the notes so you can actually see all of the notes so you can actually see all of the notes that I am creating during this stream at that I am creating during this stream at that I am creating during this stream at zen. Misha Vandenberg Donnet I'm pretty zen. Misha Vandenberg Donnet I'm pretty zen. Misha Vandenberg Donnet I'm pretty satisfied with this I set this up a satisfied with this I set this up a satisfied with this I set this up a couple of days ago it's pretty so authorized by TLS certificate um so authorized by TLS certificate um ketes ketes ketes [Music] [Music] [Music] users are authorized now do I say that users are authorized now do I say that users are authorized now do I say that right right right no are no are no are simply simply simply holders holders holders of TLS the cloud the cloud provider provider will handle issuing provider provider will handle issuing provider provider will handle issuing these certificates when the certificates when the credentials Cube config is

retrieved C ific that it has to be retrieved C ific that it has to be signed by the certificate authority of signed by the certificate authority of signed by the certificate authority of the kubernetes cluster and we will see the kubernetes cluster and we will see the kubernetes cluster and we will see how it's done in the next slide and in how it's done in the next slide and in how it's done in the next slide and in that client certificate there will be that client certificate there will be that client certificate there will be the CN the common name entry and if it's the CN the common name entry and if it's the CN the common name entry and if it's set to Jane then the username is Jane set to Jane then the username is Jane set to Jane then the username is Jane and if you then send a request to the and if you then send a request to the and if you then send a request to the cumus API containing that certificate cumus API containing that certificate cumus API containing that certificate then you will register you will be able then you will register you will be able then you will register you will be able to execute comments under the user Jan to execute comments under the user Jan to execute comments under the user Jan and H and H and H I'm going to copy this slide and add it I'm going to copy this slide and add it I'm going to copy this slide and add it into my notes here that's really client client certificate will be signed client client certificate will be signed by the cluster CA and the CN is CA and the CN is the username under the permissions that the username under the permissions that the user Jane user Jane user Jane has how can we get a certificate signed has how can we get a certificate signed has how can we get a certificate signed from kubernetes okay so the procedure from kubernetes okay so the procedure from kubernetes okay so the procedure would be first we will have to have a would be first we will have to have a would be first we will have to have a certificate signing request we simply certificate signing request we simply certificate signing request we simply create it with open SSL and we will do create it with open SSL and we will do create it with open SSL and we will do it soon in um in a Hands-On session so it soon in um in a Hands-On session so it soon in um in a Hands-On session so we create a certificate signing request we create a certificate signing request we create a certificate signing request then we can include the certificate then we can include the certificate then we can include the certificate signing request in a kubernetes resource signing request in a kubernetes resource signing request in a kubernetes resource which is called certificate signing which is called certificate signing which is called certificate signing request we send it to kubernetes

request we send it to kubernetes request we send it to kubernetes kubernetes then uses the certificate kubernetes then uses the certificate kubernetes then uses the certificate Authority which it already has access to Authority which it already has access to Authority which it already has access to like the kubernetes API server has like the kubernetes API server has like the kubernetes API server has access to the certificate access to the certificate access to the certificate Authority the API kubernetes uses this Authority the API kubernetes uses this Authority the API kubernetes uses this then to signs this certificate updates then to signs this certificate updates then to signs this certificate updates the C certificate signing request the C certificate signing request the C certificate signing request resource which then includes the um resource which then includes the um resource which then includes the um certificate and then we as a user can certificate and then we as a user can certificate and then we as a user can download it or we as an administrator download it or we as an administrator download it or we as an administrator can download it and distribute it to all can download it and distribute it to all can download it and distribute it to all users why like users why like users why like this it's not even necessary to have the this it's not even necessary to have the this it's not even necessary to have the API in the middle right if you have a API in the middle right if you have a API in the middle right if you have a certificate signing request all you have certificate signing request all you have certificate signing request all you have to have is the certificate Authority to have is the certificate Authority to have is the certificate Authority fire and then you can create the fire and then you can create the fire and then you can create the certificate but it it can be difficult certificate but it it can be difficult certificate but it it can be difficult to manage and to distribute the to manage and to distribute the to manage and to distribute the certificate Authority like when you want certificate Authority like when you want certificate Authority like when you want to sign a certificate you may have to to sign a certificate you may have to to sign a certificate you may have to download the certificate Authority from download the certificate Authority from download the certificate Authority from a server and then use it and delete it a server and then use it and delete it a server and then use it and delete it after afterwards so this is why after afterwards so this is why after afterwards so this is why kubernetes introduced the certificate kubernetes introduced the certificate kubernetes introduced the certificate signing request resource and process to signing request resource and process to signing request resource and process to make this more secure and more easy okay just a minute something about easy okay just a minute something about leaks and invalidation so there is no leaks and invalidation so there is no leaks and invalidation so there is no way to invalidate a certificate once the way to invalidate a certificate once the way to invalidate a certificate once the certificate is issued it is valid as certificate is issued it is valid as certificate is issued it is valid as long as the expiry date okay so what long as the expiry date okay so what long as the expiry date okay so what happens if a certificate has been leaked happens if a certificate has been leaked happens if a certificate has been leaked like a user reports my certific ific has like a user reports my certific ific has like a user reports my certific ific has been stolen by someone what what can you

been stolen by someone what what can you been stolen by someone what what can you do well what you can do is you could do well what you can do is you could do well what you can do is you could remove all access via robust access remove all access via robust access remove all access via robust access control so that the user doesn't have control so that the user doesn't have control so that the user doesn't have any more permissions in the cluster the any more permissions in the cluster the any more permissions in the cluster the username cannot be used anymore until username cannot be used anymore until username cannot be used anymore until the certificate expires is the certificate expires is the certificate expires is expired or you have to create a new expired or you have to create a new expired or you have to create a new certificate Authority for your cluster certificate Authority for your cluster certificate Authority for your cluster and reissue all certificates okay so and reissue all certificates okay so and reissue all certificates okay so it's not the best procedure and it's not it's not the best procedure and it's not it's not the best procedure and it's not an easy procedure what has to happen if an easy procedure what has to happen if an easy procedure what has to happen if there has been a leak we will now authenticate as a leak we will now authenticate as a normal user Jane with the cluster for normal user Jane with the cluster for normal user Jane with the cluster for this we will create a certificate and this we will create a certificate and this we will create a certificate and key and authenticate as user Jane we key and authenticate as user Jane we key and authenticate as user Jane we will create a certificate signing will create a certificate signing will create a certificate signing request we will sign it using the request we will sign it using the request we will sign it using the kubernetes API and then we will use it kubernetes API and then we will use it kubernetes API and then we will use it using the cube config to connect to the using the cube config to connect to the using the cube config to connect to the kuties API so the steps will be the kuties API so the steps will be the kuties API so the steps will be the following first we will create a key following first we will create a key following first we will create a key using op SSL same we will create a using op SSL same we will create a using op SSL same we will create a certificate signing request then we will certificate signing request then we will certificate signing request then we will send this one to the API the API server send this one to the API the API server send this one to the API the API server will sign it for us afterwards we will sign it for us afterwards we will sign it for us afterwards we download the signed certificate from the download the signed certificate from the download the signed certificate from the API and then we use it to communicate API and then we use it to communicate API and then we use it to communicate with the kubernetes API so try to follow with the kubernetes API so try to follow with the kubernetes API so try to follow along it's it's important to uh to along it's it's important to uh to along it's it's important to uh to understand this um the comments that we understand this um the comments that we understand this um the comments that we used here are also in the resources

section okay I wonder if um if this is section okay I wonder if um if this is actually part of the exam I I don't actually part of the exam I I don't actually part of the exam I I don't think so because I I don't think you think so because I I don't think you think so because I I don't think you have to know open SSL for the exam but have to know open SSL for the exam but have to know open SSL for the exam but it's still really interesting but just a it's still really interesting but just a it's still really interesting but just a thought there what do we have to do well thought there what do we have to do well thought there what do we have to do well first we have to generate a key so open first we have to generate a key so open first we have to generate a key so open SSL generate you don't have to know SSL generate you don't have to know SSL generate you don't have to know these open SSL comments by heart and these open SSL comments by heart and these open SSL comments by heart and there or you can also copy the open SSL there or you can also copy the open SSL there or you can also copy the open SSL comments from the resources section but comments from the resources section but comments from the resources section but just oh well there it is that confirmed just oh well there it is that confirmed just oh well there it is that confirmed he says you don't know have to know them he says you don't know have to know them he says you don't know have to know them by heart comfortable with these so now by heart comfortable with these so now by heart comfortable with these so now we created a we created a we created a key and um now from that key we can key and um now from that key we can key and um now from that key we can create uh Certificate signning request create uh Certificate signning request create uh Certificate signning request chain. chain. chain. CSR and in that certificate signing CSR and in that certificate signing CSR and in that certificate signing request we can leave everything empty request we can leave everything empty request we can leave everything empty but when we come to to the common name but when we come to to the common name but when we come to to the common name to the CN then as we learned this will to the CN then as we learned this will to the CN then as we learned this will be the username that we use to be the username that we use to be the username that we use to authenticate with kubernetes so it has authenticate with kubernetes so it has authenticate with kubernetes so it has to be Jane there we go we have a certificate Jane there we go we have a certificate signing request and we have a key now we signing request and we have a key now we signing request and we have a key now we would like to create a kubernetes would like to create a kubernetes would like to create a kubernetes resource which is called certificate resource which is called certificate resource which is called certificate signing request so head to the signing request so head to the signing request so head to the kubernetes documentation and search for scroll down it should be a bit down till scroll down it should be a bit down till we see an example at first they talk we see an example at first they talk we see an example at first they talk about there we go here we see one they

about there we go here we see one they about there we go here we see one they executed in one comment but we can executed in one comment but we can executed in one comment but we can simply copy the yaml out of simply copy the yaml out of simply copy the yaml out of it I create a new file CSR doyo paste it it I create a new file CSR doyo paste it it I create a new file CSR doyo paste it in okay we change the name to in okay we change the name to in okay we change the name to Jane and then the whole Jane and then the whole Jane and then the whole request um I will delete it because in the request field where I now because in the request field where I now have written to do there we have to have written to do there we have to have written to do there we have to paste the actual certificate signing paste the actual certificate signing paste the actual certificate signing request file base 64 encoded okay so I request file base 64 encoded okay so I request file base 64 encoded okay so I don't I'm not creating the resource don't I'm not creating the resource don't I'm not creating the resource right now what I now need to have is the right now what I now need to have is the right now what I now need to have is the jane. jane. jane. CSR base 64 CSR base 64 CSR base 64 encoded encoded encoded okay and what I can actually do to get okay and what I can actually do to get okay and what I can actually do to get this and the comment is also in this and the comment is also in this and the comment is also in um in the resources we can do I'm not um in the resources we can do I'm not um in the resources we can do I'm not following along with the Practical thing following along with the Practical thing following along with the Practical thing here because I don't want to mess up my here because I don't want to mess up my here because I don't want to mess up my Cube config file with another user and I Cube config file with another user and I Cube config file with another user and I don't think you actually need to know don't think you actually need to know don't think you actually need to know this for the exam but it's it's this for the exam but it's it's this for the exam but it's it's interesting to watch 64 but then I I interesting to watch 64 but then I I interesting to watch 64 but then I I understand fully what's going on here so understand fully what's going on here so understand fully what's going on here so I'm not concerned we we still have the I'm not concerned we we still have the I'm not concerned we we still have the the new line right so we can do the new line right so we can do the new line right so we can do dw0 and there we go copy it edit the resource

it edit the resource again paste it in the request section again paste it in the request section again paste it in the request section and that's and that's and that's it now we will create the it now we will create the it now we will create the resource the certificate sign a request resource the certificate sign a request resource the certificate sign a request resource it worked and we can get csrs resource it worked and we can get csrs resource it worked and we can get csrs and there is see there's our Jane CSR and there is see there's our Jane CSR and there is see there's our Jane CSR and the condition is pending so now the and the condition is pending so now the and the condition is pending so now the idea is that the idea is that the idea is that the administrator um can approve that administrator um can approve that administrator um can approve that certificate signing request okay it's certificate signing request okay it's certificate signing request okay it's it's not automated just like this it's it's not automated just like this it's it's not automated just like this it's still secure in that sense so what we still secure in that sense so what we still secure in that sense so what we can do is K can do is K can do is K certificate K certificate K certificate K certificate let me have a look certificate let me have a look certificate let me have a look approve can also have the help sections approve can also have the help sections approve can also have the help sections there is approve and den there is approve and den there is approve and den but we want to approve it and we want to but we want to approve it and we want to but we want to approve it and we want to approve certificate Jane and if we look approve certificate Jane and if we look approve certificate Jane and if we look at the certificate signing request again at the certificate signing request again at the certificate signing request again then we see now the condition is then we see now the condition is then we see now the condition is approved issued approved issued approved issued interesting I I've been working with interesting I I've been working with interesting I I've been working with csrs and stuff um for my csrs and stuff um for my csrs and stuff um for my ingresses but then I use C manager and ingresses but then I use C manager and ingresses but then I use C manager and then those are approved by CT manager so then those are approved by CT manager so then those are approved by CT manager so it's interesting to see this process it's interesting to see this process it's interesting to see this process manually you get the certificate signing manually you get the certificate signing manually you get the certificate signing request from Jane as yo then we see now request from Jane as yo then we see now request from Jane as yo then we see now in the status section we have actually in the status section we have actually in the status section we have actually the certificate that's our certificate the certificate that's our certificate the certificate that's our certificate that we can use so copy that we can use so copy that we can use so copy it it's in base 64 so we base 64 decoded

it it's in base 64 so we base 64 decoded it it's in base 64 so we base 64 decoded there we go looks great we paste it into there we go looks great we paste it into there we go looks great we paste it into a file called jane. CS CRT for a file called jane. CS CRT for a file called jane. CS CRT for certificate and that was that was much certificate and that was that was much certificate and that was that was much of the procedure already so where are we of the procedure already so where are we of the procedure already so where are we we created a key we created a we created a key we created a we created a key we created a certificate signing request we sent it certificate signing request we sent it certificate signing request we sent it to the API the API approved it for us we to the API the API approved it for us we to the API the API approved it for us we downloaded the certificate from the API downloaded the certificate from the API downloaded the certificate from the API what we now have to do is to actually what we now have to do is to actually what we now have to do is to actually use the certificate and the key to use the certificate and the key to use the certificate and the key to connect to the commat API how can we do connect to the commat API how can we do connect to the commat API how can we do this well if we have a look in our Cube this well if we have a look in our Cube this well if we have a look in our Cube config we can actually do K config view config we can actually do K config view config we can actually do K config view this is our Cube conflict file right now this is our Cube conflict file right now this is our Cube conflict file right now we have one I KN I knew this was going we have one I KN I knew this was going we have one I KN I knew this was going to come that's why I don't wanted to to to come that's why I don't wanted to to to come that's why I don't wanted to to do it because my Cube config file is do it because my Cube config file is do it because my Cube config file is full of things for work as well so full of things for work as well so full of things for work as well so cluster we have one context which cluster we have one context which cluster we have one context which connects a cluster with a user with the connects a cluster with a user with the connects a cluster with a user with the admin user and we only have one user admin user and we only have one user admin user and we only have one user down here the admin user so what we can down here the admin user so what we can down here the admin user so what we can do is we can create another user for do is we can create another user for do is we can create another user for Jane and another context for Jane which Jane and another context for Jane which Jane and another context for Jane which connects the user Jane with the connects the user Jane with the connects the user Jane with the cluster what we can do to do this is um cluster what we can do to do this is um cluster what we can do to do this is um K K K config set config set config set credentials and we call the credentials credentials and we call the credentials credentials and we call the credentials Jane and then you specify the client key Jane and then you specify the client key Jane and then you specify the client key and it's jane. key and you specify and it's jane. key and you specify and it's jane. key and you specify the client certificate which is jane.

the client certificate which is jane. the client certificate which is jane. CT CT CT okay user Jane set if we have a look at okay user Jane set if we have a look at okay user Jane set if we have a look at K config view then we actually see nice K config view then we actually see nice K config view then we actually see nice we now have a user Jan down here as well we now have a user Jan down here as well we now have a user Jan down here as well with a client certificate and client key with a client certificate and client key with a client certificate and client key mhm these are reference to the files mhm these are reference to the files mhm these are reference to the files okay down here you see that we actually okay down here you see that we actually okay down here you see that we actually have client certificate data entries have client certificate data entries have client certificate data entries which are rejected right now for which are rejected right now for which are rejected right now for security security security reasons if we want to actually include reasons if we want to actually include reasons if we want to actually include the values into our Cube config we can the values into our Cube config we can the values into our Cube config we can simply run the same commment again set simply run the same commment again set simply run the same commment again set credentials with Ed credentials with Ed credentials with Ed certificates there we go let's have a certificates there we go let's have a certificates there we go let's have a look at K config view the user was look at K config view the user was look at K config view the user was overwritten and we see now it's actually overwritten and we see now it's actually overwritten and we see now it's actually included in our Cube config file if we included in our Cube config file if we included in our Cube config file if we want to see the raw values then we can want to see the raw values then we can want to see the raw values then we can do K config view D- do K config view D- do K config view D- raw right this is enough for us right raw right this is enough for us right raw right this is enough for us right now now we need to have a context now now we need to have a context now now we need to have a context because we want to connect the user to because we want to connect the user to because we want to connect the user to the existing kubernetes cluster so the existing kubernetes cluster so the existing kubernetes cluster so similar thing we can do K config set similar thing we can do K config set similar thing we can do K config set context we call it Jane and we want to context we call it Jane and we want to context we call it Jane and we want to connect user Jane with cluster connect user Jane with cluster connect user Jane with cluster kubernetes done if we now do K config kubernetes done if we now do K config kubernetes done if we now do K config get get get contexts then we see we have a context contexts then we see we have a context contexts then we see we have a context right now the admin context and the Jane right now the admin context and the Jane right now the admin context and the Jane context so we do K config use context context so we do K config use context context so we do K config use context Jane and now we are user Jane k get Nam Jane and now we are user Jane k get Nam Jane and now we are user Jane k get Nam spaces I'm not allowed to get Nam spaces spaces I'm not allowed to get Nam spaces spaces I'm not allowed to get Nam spaces why because by ro base Access Control we

why because by ro base Access Control we why because by ro base Access Control we didn't give Jane any permissions to get didn't give Jane any permissions to get didn't give Jane any permissions to get name spaces do you remember what name spaces do you remember what name spaces do you remember what permissions Jane had well Jane should permissions Jane had well Jane should permissions Jane had well Jane should have permissions in namespace blue have permissions in namespace blue have permissions in namespace blue to list secrets so let's have a look if to list secrets so let's have a look if to list secrets so let's have a look if we can get we can get we can get Secrets there we go we can get Secrets Secrets there we go we can get Secrets Secrets there we go we can get Secrets very nice um we can also can we delete very nice um we can also can we delete very nice um we can also can we delete Secrets let's try to delete that secret Secrets let's try to delete that secret Secrets let's try to delete that secret no we have no permissions to do this so no we have no permissions to do this so no we have no permissions to do this so and here in the in the response we and here in the in the response we and here in the in the response we actually see user Jane cannot delete actually see user Jane cannot delete actually see user Jane cannot delete resources we can now also do K of can I I delete delete deployments there was like delete delete deployments there was like delete delete deployments there was like the deployment deleter can I delete the deployment deleter can I delete the deployment deleter can I delete deployments in all name spaces yes deployments in all name spaces yes deployments in all name spaces yes because we gave um through a cluster because we gave um through a cluster because we gave um through a cluster role and cluster role binding we gave role and cluster role binding we gave role and cluster role binding we gave user Jane that permission and then can user Jane that permission and then can user Jane that permission and then can can user Jane delete pots in all can user Jane delete pots in all can user Jane delete pots in all namespaces no okay so we are now namespaces no okay so we are now namespaces no okay so we are now authenticated as user Jane with the authenticated as user Jane with the authenticated as user Jane with the kubernetes cluster and we did that whole kubernetes cluster and we did that whole kubernetes cluster and we did that whole scenario which should make it scenario which should make it scenario which should make it clear I suggest if you want to get a bit clear I suggest if you want to get a bit clear I suggest if you want to get a bit more familiar with it simply do the same more familiar with it simply do the same more familiar with it simply do the same thing with user jym okay just the same thing with user jym okay just the same thing with user jym okay just the same thing that we now did with Jane goes thing that we now did with Jane goes thing that we now did with Jane goes through all these steps do it again with through all these steps do it again with through all these steps do it again with user JY and then you should have another user JY and then you should have another user JY and then you should have another entry for for for Jane and for Jim and

entry for for for Jane and for Jim and entry for for for Jane and for Jim and for the kubernetes admin in your Cube for the kubernetes admin in your Cube for the kubernetes admin in your Cube config and you can switch between the config and you can switch between the config and you can switch between the contacts and test out the permissions we reached the end of the role based we reached the end of the role based Access Control section it was a big Access Control section it was a big Access Control section it was a big section it is an important topic if you section it is an important topic if you section it is an important topic if you like to go a bit further then I suggest like to go a bit further then I suggest like to go a bit further then I suggest to really read through the using Ro to really read through the using Ro to really read through the using Ro based Access Control documentation page based Access Control documentation page based Access Control documentation page um we will also face role based Access um we will also face role based Access um we will also face role based Access Control throughout other Hands-On Control throughout other Hands-On Control throughout other Hands-On sessions and other topics because it's sessions and other topics because it's sessions and other topics because it's just a topic which is prevalent um just a topic which is prevalent um just a topic which is prevalent um almost everywhere when it comes to almost everywhere when it comes to almost everywhere when it comes to security what did we talk about well we security what did we talk about well we security what did we talk about well we talked about roles and cluster roles talked about roles and cluster roles talked about roles and cluster roles role BS applying okay so there are a few kiler applying okay so there are a few kiler Coda um scenarios here but I'm just Coda um scenarios here but I'm just Coda um scenarios here but I'm just going to find out if that is part of the going to find out if that is part of the going to find out if that is part of the cks exam if this cks exam if this cks exam if this this creating users and authenticating this creating users and authenticating this creating users and authenticating with certificate if that is actually with certificate if that is actually with certificate if that is actually something that I will need to something that I will need to something that I will need to know know know um use RB to minimize um use RB to minimize um use RB to minimize exposure service accounts exposure service accounts exposure service accounts [Music] updating properly set up Ingress updating properly set up Ingress user Ingress

okay I actually don't think that okay I actually don't think that is necessary here here yeah I'm fairly certain I don't have to yeah I'm fairly certain I don't have to yeah I'm fairly certain I don't have to actually know that but like it's not actually know that but like it's not actually know that but like it's not that I don't want to learn but it's just that I don't want to learn but it's just that I don't want to learn but it's just for me to verify whether I actually need for me to verify whether I actually need for me to verify whether I actually need to know this so let's see the um check to know this so let's see the um check to know this so let's see the um check out out out the resources the resources the resources here here here [Music] [Music] [Music] scenarios uh hardening arback are a few here that need to be arback are a few here that need to be run what is wrong with my Vim though run what is wrong with my Vim though run what is wrong with my Vim though like something is because I've been switching windows is because I've been switching windows so much something is a bit weird scenarios scenarios maybe I should just do it maybe I should just do it maybe I should just do it ckss course ckss course ckss course [Music] [Music] [Music] environment it is rendered as a table so environment it is rendered as a table so environment it is rendered as a table so that's a bit nicer that's a bit nicer that's a bit nicer scenarios scenarios scenarios here arback arback service account permissions I have about 15 minutes left permissions I have about 15 minutes left so I think I'm just going to do one or so I think I'm just going to do one or so I think I'm just going to do one or two scenarios and then I'll have to call two scenarios and then I'll have to call two scenarios and then I'll have to call it a it a it a day actually I can only do one and then day actually I can only do one and then day actually I can only do one and then I'll have to um get ready for the Easter I'll have to um get ready for the Easter I'll have to um get ready for the Easter Branch let's see there are existing

Branch let's see there are existing Branch let's see there are existing namespaces Nam space one and two create namespaces Nam space one and two create namespaces Nam space one and two create service account pipeline in both service account pipeline in both service account pipeline in both namespaces these service accounts should namespaces these service accounts should namespaces these service accounts should be allowed to view almost everything in be allowed to view almost everything in be allowed to view almost everything in the whole cluster okay so let's see K create cluster okay so let's see K create service account pipeline N pipeline N ns1 ns2 View almost everything in the whole ns2 View almost everything in the whole cluster so K create cluster roll cluster so K create cluster roll cluster so K create cluster roll binding one cluster one cluster roll roll roll View and then is it user or service View and then is it user or service View and then is it user or service account okay create cluster roll plus cluster roll plus cluster roll user service account is namespace service

service account is namespace service account name that's the usage okay account name that's the usage okay account name that's the usage okay [Music] [Music] [Music] so I'm going to open t-o and here I'm going to do that again t-o and here I'm going to do that again so okay create cluster roll so okay create cluster roll so okay create cluster roll binding pipe to binding pipe to binding pipe to L service binding cluster binding cluster [Music] cluster roll is cluster roll is view then service view then service view then service account is account is account is ns1 ns2 ns2 set OVI cluster viewer

OVI cluster viewer two so that is created so let's two so that is created so let's two so that is created so let's verify verify verify um Kos can so okay off can I list so okay off can I list pods pods pods as as as system service system service system service account cluster viewer one account cluster viewer one account cluster viewer one the cluster viewer of namespace viewer of namespace one in N pods Can you pods Can you [Music] [Music] [Music] view of view is another known he should know it right he should be he should know it right he should be able to list

view um okay get cluster view um okay get cluster roll view oh yo get list get list watch okay so why is he not allowed to do that okay so why is he not allowed to do that then can I view pods as service account then can I view pods as service account then can I view pods as service account cluster viewer living in the namespace cluster viewer living in the namespace cluster viewer living in the namespace one so K one so K one so K ns1 ns1 ns1 get get get [Music] [Music] [Music] service viewer so then K create cluster rooll viewer so then K create cluster rooll binding cluster viewer binding cluster viewer binding cluster viewer one cluster rule is one cluster rule is one cluster rule is view service account is ns1

view service account is ns1 view service account is ns1 one pipeline okay got cluster roll pipeline okay got cluster roll bindings bindings bindings [Music] [Music] cluster n ns1 cluster n ns1 cluster viewer so chaos can so chaos can I um K off can I list pods um K off can I list pods as system service as system service as system service account NS one okay well actually I have to leave now I

okay well actually I have to leave now I have to get ready so I I think I'll have have to get ready so I I think I'll have have to get ready so I I think I'll have to cut it off short here I'm I'm sorry to cut it off short here I'm I'm sorry to cut it off short here I'm I'm sorry about that but um this is why these I'm about that but um this is why these I'm about that but um this is why these I'm going to be practicing these scenarios going to be practicing these scenarios going to be practicing these scenarios every single day because this stuff every single day because this stuff every single day because this stuff needs to be in the fingers you need to needs to be in the fingers you need to needs to be in the fingers you need to be able to read this and just do it be able to read this and just do it be able to read this and just do it instantly uh and this is one of my weak instantly uh and this is one of my weak instantly uh and this is one of my weak points Network policies and role based points Network policies and role based points Network policies and role based Access Control uh so I'm uh I need to do Access Control uh so I'm uh I need to do Access Control uh so I'm uh I need to do a lot more practice but that's what it's a lot more practice but that's what it's a lot more practice but that's what it's all about right so yeah thanks for all about right so yeah thanks for all about right so yeah thanks for tuning in I uh have to go to my Easter tuning in I uh have to go to my Easter tuning in I uh have to go to my Easter Branch now so maybe I'll do another Branch now so maybe I'll do another Branch now so maybe I'll do another stream later this week and I'll see you stream later this week and I'll see you stream later this week and I'll see you in the next one have a good